16/07/2026 09:59:43 UTC
TCP
8090 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:8090 · (tentative d'exploit) · → /api/route
Élevée
Élevé · 76
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/route UA Mozilla/5.0 (Linux; Android 9; AFTWMST22 Build/PS7233; wv) Appl…
Émulateur
HTTP
WAF
62
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/api/route
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8090
Chemin / cible
/api/route
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 76
Confiance : Confiance 95 % — Motif catalogue confirmé · 10 tag(s) WAF
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /api/route HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 9; AFTWMST22 Build/PS7233; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/88.0.4324.152 Mobile Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
k8s-api
Payload (extrait)
POST /api/route HTTP/1.1
Host: 62.3.50.33:8090
Content-Length: 508
Connection: close
User-Agent: Mozilla/5.0 (Linux; Android
Requête brute (extrait)
POST /api/route HTTP/1.1 Host: 62.3.50.33:8090 Content-Length: 508 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 9; AFTWMST22 Build/PS7233; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/88.0.4324.152 Mobile Safari/537.36 Ac
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "1cafc1ec7983977ff1b9c77c60e09ef5fe869a95",
"http_host_hash": "112b403ea5b0e3a7d0d331ab96d728785c3ab96b",
"http_target_hash": "1a9b2c3dbe8a713bfc0c240bb1a6ea2141b55601",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 970,
"payload_entropy": 5.671895190005402,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 8090,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 7.8,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 76,
"tag_count": 16,
"anomaly_count": 0,
"campaign_key": "58ebf4532ea134bc242db180176937ab80dba7da",
"event_fingerprint": "83abed6cc5769db81c431c3665a2646c7e8dd649",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 76,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c772734c6eb2978096c283068906aec3",
"payload_hash": "40a80ce9573418531fba1c33e492d4d6",
"path_pattern_hash": "7c4fe35e07eebe8bea27a36c14378e32"
},
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 76
},
"payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nContent-Length: 508\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android",
"method": "POST",
"path": "\/api\/route",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api\/route HTTP\/1.1",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nContent-Length: 508\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36\r\nAc",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nContent-Length: 508\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android",
"evidence": {
"method": "POST",
"path": "\/api\/route",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api\/route HTTP\/1.1",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nContent-Length: 508\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36\r\nAc",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nContent-Length: 508\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b0f1db56878c85b4ed6c081e14a0cc8468b5f003",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/route",
"request_line": "POST \/api\/route HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88\u2026",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nContent-Length: 508\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8090 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 76\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 76,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 76,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/route",
"request_line": "POST \/api\/route HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88\u2026",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8090 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nContent-Length: 508\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 10 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8090"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api",
"http_api_route_probe",
"http_contenttype_attack_surface",
"http_probe_api",
"http_prototype_pollution",
"http_ssti",
"net_web_probe"
]
}
16/07/2026 09:59:42 UTC
TCP
8090 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:8090 · (tentative d'exploit) · → /app
Élevée
Élevé · 76
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /app UA Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWeb…
Émulateur
HTTP
WAF
52
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/app
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8090
Chemin / cible
/app
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 76
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /app HTTP/1.1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/134.0.6998.99 Mobile/15E148 Safari/604.1
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /app HTTP/1.1
Host: 62.3.50.33:8090
Content-Length: 512
Connection: close
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone O
Requête brute (extrait)
POST /app HTTP/1.1 Host: 62.3.50.33:8090 Content-Length: 512 Connection: close User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/134.0.6998.99 Mobile/15E148 Safari/604.1 Accept-Encoding:
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "affd667937319ba36aa098ac5e3b53f4e282c1fe",
"http_host_hash": "112b403ea5b0e3a7d0d331ab96d728785c3ab96b",
"http_target_hash": "0c35eebf403cf91fe77a64921d76aa1ca6411d20",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 961,
"payload_entropy": 5.660012908214772,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 8090,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 7.8,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 76,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "eb48f633564b4cc00859247d14f96d8e05eea091",
"event_fingerprint": "c180cd18b68c78be1830d8dc16d70106f7edffad",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 76,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "6990db627a3d5a6ae3f8a2c22924225b",
"payload_hash": "e5b14fd4a139b536a345b62218870d60",
"path_pattern_hash": "f53b52ad6d21cceb72dfa78fb67614fe"
},
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 76
},
"payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone O",
"method": "POST",
"path": "\/app",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/app HTTP\/1.1",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1\r\nAccept-Encoding: ",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone O",
"evidence": {
"method": "POST",
"path": "\/app",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/app HTTP\/1.1",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1\r\nAccept-Encoding: ",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone O",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9688da1ff5fcbef40a2a63bd20572600351e0dbc",
"protocol_details": {
"http_method": "POST",
"http_path": "\/app",
"request_line": "POST \/app HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mob\u2026",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone O",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8090 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 76\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 76,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 76,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/app",
"request_line": "POST \/app HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mob\u2026",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8090 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone O",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8090"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti",
"net_web_probe"
]
}
16/07/2026 09:59:41 UTC
TCP
8090 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:8090 · (tentative d'exploit) · → /_next/server
Élevée
Élevé · 76
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /_next/server UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like…
Émulateur
HTTP
WAF
58
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/_next/server
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8090
Chemin / cible
/_next/server
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 76
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /_next/server HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /_next/server HTTP/1.1
Host: 62.3.50.33:8090
Content-Length: 522
Connection: close
User-Agent: Mozilla/5.0 (X11; Linux
Requête brute (extrait)
POST /_next/server HTTP/1.1 Host: 62.3.50.33:8090 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: x X
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "1c1f86ba252c0c8ebc250acab48718f12d6d1efd",
"http_host_hash": "112b403ea5b0e3a7d0d331ab96d728785c3ab96b",
"http_target_hash": "bef481449499f499a0b29ed75c9630076205b04f",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 943,
"payload_entropy": 5.663871011932332,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 8090,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 7.8,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 76,
"tag_count": 13,
"anomaly_count": 0,
"campaign_key": "9113f22726749b3528050afb70fa1292e14c509d",
"event_fingerprint": "85b030999b42222767e4b8af2d2b591380880d03",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 76,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "72d43eb808798db218d063798749cc39",
"payload_hash": "cd6c1eb7a1d539a73f6de22c249c861a",
"path_pattern_hash": "4d9c4ca8a8065d3ce7073b6b23f61056"
},
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 76
},
"payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux ",
"method": "POST",
"path": "\/_next\/server",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next\/server HTTP\/1.1",
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux",
"evidence": {
"method": "POST",
"path": "\/_next\/server",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next\/server HTTP\/1.1",
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d07306f3a63a0cf277c6e3b7133a1199f58a3c52",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next\/server",
"request_line": "POST \/_next\/server HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8090 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 76\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 76,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 76,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next\/server",
"request_line": "POST \/_next\/server HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8090 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8090"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti",
"net_web_probe"
]
}
16/07/2026 09:59:40 UTC
TCP
8090 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:8090 · (tentative d'exploit) · → /api
Élevée
Élevé · 76
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
56
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/api
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8090
Chemin / cible
/api
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 76
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /api HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
k8s-api
Payload (extrait)
POST /api HTTP/1.1
Host: 62.3.50.33:8090
Content-Length: 512
Connection: close
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win
Requête brute (extrait)
POST /api HTTP/1.1 Host: 62.3.50.33:8090 Content-Length: 512 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: x
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "0703723cf11531696e7769eb22f8d9b281390533",
"http_host_hash": "112b403ea5b0e3a7d0d331ab96d728785c3ab96b",
"http_target_hash": "ada91241341ae792ecf0a59cad28616a77bab856",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 930,
"payload_entropy": 5.6448036833485045,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 8090,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 7.8,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 76,
"tag_count": 14,
"anomaly_count": 0,
"campaign_key": "69e9d437d2c1492c6d3449fae81ea19a22959c8a",
"event_fingerprint": "e019ca69fad0459421713c4ba76ab83f31b6dc13",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 76,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c9d890423bdd8f672926a6e46bf361c3",
"payload_hash": "b3f95a87c505f822b3b29171deed956e",
"path_pattern_hash": "702acf7c08d3b03b321d97b4903ad221"
},
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 76
},
"payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"method": "POST",
"path": "\/api",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api HTTP\/1.1",
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\n",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"evidence": {
"method": "POST",
"path": "\/api",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api HTTP\/1.1",
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\n",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f7786b3c2c715eb0437dae3b15a6a44a3dddf1a7",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api",
"request_line": "POST \/api HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8090 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 76\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 76,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 76,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api",
"request_line": "POST \/api HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8090 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8090"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api",
"http_contenttype_attack_surface",
"http_probe_api",
"http_prototype_pollution",
"http_ssti",
"net_web_probe"
]
}
16/07/2026 09:59:39 UTC
TCP
8090 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:8090 · (tentative d'exploit) · → /_next
Élevée
Élevé · 76
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /_next UA Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWeb…
Émulateur
HTTP
WAF
52
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/_next
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8090
Chemin / cible
/_next
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 76
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /_next HTTP/1.1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/134.0.6998.99 Mobile/15E148 Safari/604.1
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /_next HTTP/1.1
Host: 62.3.50.33:8090
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone
Requête brute (extrait)
POST /_next HTTP/1.1 Host: 62.3.50.33:8090 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/134.0.6998.99 Mobile/15E148 Safari/604.1 Accept-Encoding
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "affd667937319ba36aa098ac5e3b53f4e282c1fe",
"http_host_hash": "112b403ea5b0e3a7d0d331ab96d728785c3ab96b",
"http_target_hash": "afd9bdeafd8c657f6b493ada03c51e348516227b",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 971,
"payload_entropy": 5.659919167104085,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 8090,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 7.8,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 76,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "eb48f633564b4cc00859247d14f96d8e05eea091",
"event_fingerprint": "68bb3d19bc4e97e48dfa3fe78d1eb8a17b4d5037",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 76,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "6990db627a3d5a6ae3f8a2c22924225b",
"payload_hash": "7123aee61ee13bc37034fd4fde2fab58",
"path_pattern_hash": "bfd33612e3863357684bd23d10455a76"
},
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 76
},
"payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone",
"method": "POST",
"path": "\/_next",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next HTTP\/1.1",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1\r\nAccept-Encoding",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone",
"evidence": {
"method": "POST",
"path": "\/_next",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next HTTP\/1.1",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1\r\nAccept-Encoding",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a33b84150fa569ff79c3dc6a5616d409af124bdd",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next",
"request_line": "POST \/_next HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mob\u2026",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8090 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 76\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 76,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 76,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next",
"request_line": "POST \/_next HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mob\u2026",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8090 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8090"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti",
"net_web_probe"
]
}
16/07/2026 09:59:37 UTC
TCP
8090 · HTTP ALT 8090
http-alt-8090
http-alt-8090 · via HTTP ALT 8090:8090 · (sonde / probe)
Faible
Faible · 0
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
HTTP-ALT-8090
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8090
Chemin / cible
—
Pourquoi cette classification : Type « http-alt-8090 » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 0
Confiance : Confiance faible (0 %) — classification prudente
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http-alt-8090",
"app_proto": "http-alt-8090",
"asn": 49870,
"country": "SC",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.8,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 0,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "074fcf7b6621f792f12eafd4c85696050ae26041",
"event_fingerprint": "73de1024b23993e40693db328fc9a5b5266e5167",
"classification_reason": "Type \u00ab http-alt-8090 \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"named_classification_skipped": false,
"service_name": "http-alt-8090",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "ced820066cc8b42921bb5be056af57a9"
},
"target_context": {
"dst_port": 8090,
"service": "http-alt-8090",
"service_name": "http-alt-8090",
"risk_score": 0
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1ca906e7588cc1b86ee9225c7c11e40f3d44efb1",
"protocol_details": {
"port": 8090,
"service": "http-alt-8090",
"service_label_fr": "HTTP ALT 8090"
},
"attack_vector": "http-alt-8090 \u00b7 via HTTP ALT 8090:8090 \u00b7 (sonde \/ probe)",
"target_port_label": "8090 \u00b7 HTTP ALT 8090",
"emulator_service": "http-alt-8090",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http-alt-8090 \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab http-alt-8090 \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 0,
"risk_label": "Faible",
"service_name": "http-alt-8090",
"service_label_fr": "HTTP ALT 8090",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http-alt-8090",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 8090,
"service": "http-alt-8090",
"service_label_fr": "HTTP ALT 8090"
},
"attack_vector": "http-alt-8090 \u00b7 via HTTP ALT 8090:8090 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "8090 \u00b7 HTTP ALT 8090",
"emulator_service": "http-alt-8090",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http_alt_8090",
"service_banner": "honeypot-http-alt-8090",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
16/07/2026 09:59:37 UTC
TCP
8090 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:8090 · (tentative d'exploit)
Élevée
Élevé · 76
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
55
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8090
Chemin / cible
/
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 76
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST / HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
sap-sapcontrol-path
Payload (extrait)
POST / HTTP/1.1
Host: 62.3.50.33:8090
Content-Length: 522
Connection: close
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64;
Requête brute (extrait)
POST / HTTP/1.1 Host: 62.3.50.33:8090 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: x X-N
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "0703723cf11531696e7769eb22f8d9b281390533",
"http_host_hash": "112b403ea5b0e3a7d0d331ab96d728785c3ab96b",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 941,
"payload_entropy": 5.642870433563269,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 8090,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 7.8,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 76,
"tag_count": 13,
"anomaly_count": 0,
"campaign_key": "0ad4fd92a5faf05ad3f552790104200d5f914f3e",
"event_fingerprint": "45109c268e6d6a3a070d61a33f62f447768db599",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 76,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c9d890423bdd8f672926a6e46bf361c3",
"payload_hash": "2440f22e749cee47948553cb69f6718d",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 76
},
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-N",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"evidence": {
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-N",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fe8caf2ee8c5678dd3b0088f7ab89b4addcd2fb4",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8090 \u00b7 (tentative d'exploit)",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 76\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 76,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 76,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8090 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8090"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti",
"net_web_probe"
]
}
16/07/2026 09:38:36 UTC
TCP
3003 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:3003 · (tentative d'exploit) · → /_next/server
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /_next/server UA Mozilla/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build/…
Émulateur
HTTP
WAF
58
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/_next/server
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
3003
Chemin / cible
/_next/server
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /_next/server HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /_next/server HTTP/1.1
Host: 62.3.50.33:3003
Content-Length: 522
Connection: close
User-Agent: Mozilla/5.0 (Linux; U; A
Requête brute (extrait)
POST /_next/server HTTP/1.1 Host: 62.3.50.33:3003 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30 Accept-Encoding:
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "22d9380abcdf97c82db21728e444020cf16735ea",
"http_host_hash": "ba69412b709442b81f116b2462e5c7df132295f9",
"http_target_hash": "bef481449499f499a0b29ed75c9630076205b04f",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 976,
"payload_entropy": 5.671692095815552,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 3003,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 7.3,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "4d85db29461cfb58527433c1ac318186797c173b",
"event_fingerprint": "b960abe7b5f1e84bd09d5d767b2686644077c0d7",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "6c8160595869adea51d6742918f57fdf",
"payload_hash": "4f55a5325bab6c9f5b1b40efb7ead6cf",
"path_pattern_hash": "4d9c4ca8a8065d3ce7073b6b23f61056"
},
"target_context": {
"dst_port": 3003,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3003\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; A",
"method": "POST",
"path": "\/_next\/server",
"user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next\/server HTTP\/1.1",
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3003\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30\r\nAccept-Encoding:",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3003\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; A",
"evidence": {
"method": "POST",
"path": "\/_next\/server",
"user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next\/server HTTP\/1.1",
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3003\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30\r\nAccept-Encoding:",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3003\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; A",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1954aa7be85cfa5c6f8b279caa7c59b988647449",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next\/server",
"request_line": "POST \/_next\/server HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.\u2026",
"port": 3003,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3003\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; A",
"attack_vector": "http smuggling probe \u00b7 via HTTP:3003 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
"target_port_label": "3003 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3003,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next\/server",
"request_line": "POST \/_next\/server HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.\u2026",
"port": 3003,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:3003 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3003\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; A",
"target_port_label": "3003 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3003"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:3003"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
16/07/2026 09:38:36 UTC
TCP
3003 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:3003 · (tentative d'exploit) · → /app
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /app UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like…
Émulateur
HTTP
WAF
52
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/app
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
3003
Chemin / cible
/app
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /app HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /app HTTP/1.1
Host: 62.3.50.33:3003
Content-Length: 517
Connection: close
User-Agent: Mozilla/5.0 (X11; Linux x86_64) A
Requête brute (extrait)
POST /app HTTP/1.1 Host: 62.3.50.33:3003 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: x X-Nextjs-R
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "1c1f86ba252c0c8ebc250acab48718f12d6d1efd",
"http_host_hash": "ba69412b709442b81f116b2462e5c7df132295f9",
"http_target_hash": "0c35eebf403cf91fe77a64921d76aa1ca6411d20",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 927,
"payload_entropy": 5.671996873043225,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 3003,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 7.3,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 11,
"anomaly_count": 0,
"campaign_key": "fe24b2feb1388c3327ad2b1acd0d1f99eb97cdcf",
"event_fingerprint": "537383a6d03bb7e493b62c0c9941aee0dc64d91f",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "72d43eb808798db218d063798749cc39",
"payload_hash": "4863b8bf59f9712286714b5a34bd3825",
"path_pattern_hash": "f53b52ad6d21cceb72dfa78fb67614fe"
},
"target_context": {
"dst_port": 3003,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3003\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) A",
"method": "POST",
"path": "\/app",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/app HTTP\/1.1",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3003\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-R",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3003\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) A",
"evidence": {
"method": "POST",
"path": "\/app",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/app HTTP\/1.1",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3003\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-R",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3003\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) A",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6b89fba5648d24c200b9c1179fc26ae6da939bdc",
"protocol_details": {
"http_method": "POST",
"http_path": "\/app",
"request_line": "POST \/app HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 3003,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3003\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) A",
"attack_vector": "http smuggling probe \u00b7 via HTTP:3003 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
"target_port_label": "3003 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3003,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/app",
"request_line": "POST \/app HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 3003,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:3003 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3003\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) A",
"target_port_label": "3003 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3003"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:3003"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
16/07/2026 09:38:36 UTC
TCP
3003 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:3003 · (tentative d'exploit) · → /api/route
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/route UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
62
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/api/route
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
3003
Chemin / cible
/api/route
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 10 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /api/route HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
k8s-api
Payload (extrait)
POST /api/route HTTP/1.1
Host: 62.3.50.33:3003
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (Windows NT 10.
Requête brute (extrait)
POST /api/route HTTP/1.1 Host: 62.3.50.33:3003 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Actio
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "0703723cf11531696e7769eb22f8d9b281390533",
"http_host_hash": "ba69412b709442b81f116b2462e5c7df132295f9",
"http_target_hash": "1a9b2c3dbe8a713bfc0c240bb1a6ea2141b55601",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 944,
"payload_entropy": 5.658251850501831,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 3003,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 7.3,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 15,
"anomaly_count": 0,
"campaign_key": "9d10b245167ca946e94ced68ba712854c6fd5119",
"event_fingerprint": "6256d16b19dee00860885185c736b3a76d1d8371",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c9d890423bdd8f672926a6e46bf361c3",
"payload_hash": "694f1febbc32d775d4582d83d3ce5585",
"path_pattern_hash": "7c4fe35e07eebe8bea27a36c14378e32"
},
"target_context": {
"dst_port": 3003,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3003\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"method": "POST",
"path": "\/api\/route",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api\/route HTTP\/1.1",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3003\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Actio",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3003\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"evidence": {
"method": "POST",
"path": "\/api\/route",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api\/route HTTP\/1.1",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3003\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Actio",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3003\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0d9b9bc50aeeff4e82a0204d71a953c46def1559",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/route",
"request_line": "POST \/api\/route HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 3003,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3003\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"attack_vector": "http smuggling probe \u00b7 via HTTP:3003 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
"target_port_label": "3003 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3003,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/route",
"request_line": "POST \/api\/route HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 3003,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:3003 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3003\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"target_port_label": "3003 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 10 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3003"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:3003"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api",
"http_api_route_probe",
"http_contenttype_attack_surface",
"http_probe_api",
"http_prototype_pollution",
"http_ssti"
]
}
16/07/2026 09:38:34 UTC
TCP
3003 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:3003 · (tentative d'exploit) · → /api
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100…
Émulateur
HTTP
WAF
56
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/api
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
3003
Chemin / cible
/api
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /api HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136.
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
k8s-api
Payload (extrait)
POST /api HTTP/1.1
Host: 62.3.50.33:3003
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win
Requête brute (extrait)
POST /api HTTP/1.1 Host: 62.3.50.33:3003 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136. Accept-Encoding: gzip, deflate Next-Action: x X-Nextjs-Request-Id: poop1234 C
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "fac64969f9eca34262c56352be2d62dd2d22b1a0",
"http_host_hash": "ba69412b709442b81f116b2462e5c7df132295f9",
"http_target_hash": "ada91241341ae792ecf0a59cad28616a77bab856",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 906,
"payload_entropy": 5.60732701312041,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 3003,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 7.3,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 13,
"anomaly_count": 0,
"campaign_key": "1bb5f72c3bd344accd3c2656b2505773d5b0c6bc",
"event_fingerprint": "5cbfd0755a4a3aa22c4591b46a26d7d4b9c1a7db",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "9f10b48170735feac18b44fa385fef37",
"payload_hash": "e721728071ba76b09b4b868a7f894ef2",
"path_pattern_hash": "702acf7c08d3b03b321d97b4903ad221"
},
"target_context": {
"dst_port": 3003,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3003\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"method": "POST",
"path": "\/api",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api HTTP\/1.1",
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3003\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-Request-Id: poop1234\r\nC",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3003\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"evidence": {
"method": "POST",
"path": "\/api",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api HTTP\/1.1",
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3003\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-Request-Id: poop1234\r\nC",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3003\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0c4fc48481d43093a1c847b4c0d3a472ccce3887",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api",
"request_line": "POST \/api HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
"port": 3003,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3003\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"attack_vector": "http smuggling probe \u00b7 via HTTP:3003 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
"target_port_label": "3003 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3003,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api",
"request_line": "POST \/api HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
"port": 3003,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:3003 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3003\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"target_port_label": "3003 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3003"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:3003"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api",
"http_contenttype_attack_surface",
"http_probe_api",
"http_prototype_pollution",
"http_ssti"
]
}
16/07/2026 09:38:33 UTC
TCP
3003 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:3003 · (tentative d'exploit) · → /_next
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /_next UA Mozilla/5.0 (Linux; Android 14; SM-F9560 Build/UP1A.231005.007;…
Émulateur
HTTP
WAF
52
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/_next
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
3003
Chemin / cible
/_next
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /_next HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 14; SM-F9560 Build/UP1A.231005.007; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/127.0.6533.103 Mobile Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /_next HTTP/1.1
Host: 62.3.50.33:3003
Content-Length: 513
Connection: close
User-Agent: Mozilla/5.0 (Linux; Android 14;
Requête brute (extrait)
POST /_next HTTP/1.1 Host: 62.3.50.33:3003 Content-Length: 513 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 14; SM-F9560 Build/UP1A.231005.007; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/127.0.6533.103 Mobile Safari/537.
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "1978af5307537775fab4b66b0f1439319be37ce1",
"http_host_hash": "ba69412b709442b81f116b2462e5c7df132295f9",
"http_target_hash": "afd9bdeafd8c657f6b493ada03c51e348516227b",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 983,
"payload_entropy": 5.641716998122119,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 3003,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 7.3,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 11,
"anomaly_count": 0,
"campaign_key": "fe24b2feb1388c3327ad2b1acd0d1f99eb97cdcf",
"event_fingerprint": "c1810ba81a464f792d9194067688cb8c03ba30f9",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "7967be4fa492cfad4b86b41e3ae090e9",
"payload_hash": "080252c48f26710f9a9fffcfeb21d1a9",
"path_pattern_hash": "bfd33612e3863357684bd23d10455a76"
},
"target_context": {
"dst_port": 3003,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3003\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
"method": "POST",
"path": "\/_next",
"user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next HTTP\/1.1",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3003\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3003\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
"evidence": {
"method": "POST",
"path": "\/_next",
"user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next HTTP\/1.1",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3003\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3003\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cd7608a08e26dd54728bb48b57c42d59f58ea6d3",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next",
"request_line": "POST \/_next HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 \u2026",
"port": 3003,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3003\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
"attack_vector": "http smuggling probe \u00b7 via HTTP:3003 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
"target_port_label": "3003 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3003,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next",
"request_line": "POST \/_next HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 \u2026",
"port": 3003,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:3003 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3003\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
"target_port_label": "3003 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3003"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:3003"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
16/07/2026 09:38:32 UTC
TCP
3003 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:3003 · (tentative d'exploit)
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST / UA Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KH…
Émulateur
HTTP
WAF
55
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
3003
Chemin / cible
/
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST / HTTP/1.1
User-Agent
Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
sap-sapcontrol-path
Payload (extrait)
POST / HTTP/1.1
Host: 62.3.50.33:3003
Content-Length: 513
Connection: close
User-Agent: Mozilla/5.0 (X11; CrOS x86_64 14541.
Requête brute (extrait)
POST / HTTP/1.1 Host: 62.3.50.33:3003 Content-Length: 513 Connection: close User-Agent: Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: x X-Ne
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "d336075c3988c6b7205cebd57d13f49ace6a0b3b",
"http_host_hash": "ba69412b709442b81f116b2462e5c7df132295f9",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 927,
"payload_entropy": 5.642508376341771,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 3003,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 7.3,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "492cb37276e44f5d65bd5022807da5e2bc57d600",
"event_fingerprint": "fa11ebca78be132b0123957f01198111d6b25f56",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "5ea6889a59d080298a42c0e1b4758211",
"payload_hash": "2977c63d8beb9df1db87652aa58f9124",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 3003,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3003\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.",
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3003\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Ne",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3003\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.",
"evidence": {
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3003\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Ne",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3003\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d9cf8eaf8751a810eb00a65a025988cad6c5f517",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 3003,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3003\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.",
"attack_vector": "http smuggling probe \u00b7 via HTTP:3003 \u00b7 (tentative d'exploit)",
"target_port_label": "3003 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3003,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 3003,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:3003 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3003\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.",
"target_port_label": "3003 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3003"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:3003"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
16/07/2026 09:38:31 UTC
TCP
3003
—
Sonde port
Sonde port · port 3003 · (sonde / probe)
Faible
Moyen · 44
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
3003
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": null,
"app_proto": null,
"asn": 49870,
"country": "SC",
"dst_port": 3003,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "dab6a81d38d27aadb06aad499fffc47e4d746855",
"event_fingerprint": "9a841e79870f59f81b076dcf4286aa06b40fbadf",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 3003,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f8a6d89ed1d0324f81f5b00f07615f0d356b0fe8",
"protocol_details": {
"port": 3003
},
"attack_vector": "Sonde port \u00b7 port 3003 \u00b7 (sonde \/ probe)",
"target_port_label": "3003",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 3003,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"port": 3003
},
"attack_vector": "Sonde port \u00b7 port 3003 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "3003",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "3003"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
16/07/2026 08:58:59 UTC
TCP
8001 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:8001 · (tentative d'exploit) · → /app
Élevée
Élevé · 72
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /app UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
52
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/app
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8001
Chemin / cible
/app
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 72
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /app HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /app HTTP/1.1
Host: 62.3.50.33:8001
Content-Length: 508
Connection: close
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win
Requête brute (extrait)
POST /app HTTP/1.1 Host: 62.3.50.33:8001 Content-Length: 508 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: x
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "0703723cf11531696e7769eb22f8d9b281390533",
"http_host_hash": "29d114ae8a3567c5f1863f5bd79c5d398a432fe8",
"http_target_hash": "0c35eebf403cf91fe77a64921d76aa1ca6411d20",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 924,
"payload_entropy": 5.653930216577311,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 8001,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 3.5,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 72,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "c8c3fc385382ab9e7d62a5bf704b712a07bf4921",
"event_fingerprint": "f3b0d2a90f973b1c2ff0947d6c7a4b612a23528f",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c9d890423bdd8f672926a6e46bf361c3",
"payload_hash": "1d418b5e5a644f4665256dc750cd7fe2",
"path_pattern_hash": "f53b52ad6d21cceb72dfa78fb67614fe"
},
"target_context": {
"dst_port": 8001,
"service": "http",
"service_name": "http",
"risk_score": 72
},
"payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nContent-Length: 508\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"method": "POST",
"path": "\/app",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/app HTTP\/1.1",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nContent-Length: 508\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\n",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nContent-Length: 508\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"evidence": {
"method": "POST",
"path": "\/app",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/app HTTP\/1.1",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nContent-Length: 508\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\n",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nContent-Length: 508\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f5bee03228d1d1b3236ca332410dadfbb99decd1",
"protocol_details": {
"http_method": "POST",
"http_path": "\/app",
"request_line": "POST \/app HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 8001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nContent-Length: 508\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
"target_port_label": "8001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 72\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 72,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8001,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/app",
"request_line": "POST \/app HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 8001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nContent-Length: 508\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"target_port_label": "8001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8001"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti",
"net_web_probe"
]
}
16/07/2026 08:58:59 UTC
TCP
8001 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:8001 · (tentative d'exploit) · → /api/route
Élevée
Élevé · 72
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/route UA Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KH…
Émulateur
HTTP
WAF
62
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/api/route
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8001
Chemin / cible
/api/route
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 72
Confiance : Confiance 95 % — Motif catalogue confirmé · 10 tag(s) WAF
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /api/route HTTP/1.1
User-Agent
Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
k8s-api
Payload (extrait)
POST /api/route HTTP/1.1
Host: 62.3.50.33:8001
Content-Length: 517
Connection: close
User-Agent: Mozilla/5.0 (X11; CrOS x86_
Requête brute (extrait)
POST /api/route HTTP/1.1 Host: 62.3.50.33:8001 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "d336075c3988c6b7205cebd57d13f49ace6a0b3b",
"http_host_hash": "29d114ae8a3567c5f1863f5bd79c5d398a432fe8",
"http_target_hash": "1a9b2c3dbe8a713bfc0c240bb1a6ea2141b55601",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 942,
"payload_entropy": 5.648209261552691,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 8001,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 3.5,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 72,
"tag_count": 16,
"anomaly_count": 0,
"campaign_key": "48c8aac1a21ffd7a86702364249d50ccebd914ce",
"event_fingerprint": "dbf67c5c13a8a32592d7c5556401aa2a92030a73",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "5ea6889a59d080298a42c0e1b4758211",
"payload_hash": "9063e20a23cc2d90e374955de30b4bba",
"path_pattern_hash": "7c4fe35e07eebe8bea27a36c14378e32"
},
"target_context": {
"dst_port": 8001,
"service": "http",
"service_name": "http",
"risk_score": 72
},
"payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_",
"method": "POST",
"path": "\/api\/route",
"user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api\/route HTTP\/1.1",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_",
"evidence": {
"method": "POST",
"path": "\/api\/route",
"user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api\/route HTTP\/1.1",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7fcf6a43062c8516c9e62b64878b13cfbfdc8159",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/route",
"request_line": "POST \/api\/route HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 8001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
"target_port_label": "8001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 72\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 72,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8001,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/route",
"request_line": "POST \/api\/route HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 8001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_",
"target_port_label": "8001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 10 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8001"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api",
"http_api_route_probe",
"http_contenttype_attack_surface",
"http_probe_api",
"http_prototype_pollution",
"http_ssti",
"net_web_probe"
]
}
16/07/2026 08:58:58 UTC
TCP
8001 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:8001 · (tentative d'exploit) · → /api
Élevée
Élevé · 72
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api UA Mozilla/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build/…
Émulateur
HTTP
WAF
56
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/api
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8001
Chemin / cible
/api
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 72
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /api HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
k8s-api
Payload (extrait)
POST /api HTTP/1.1
Host: 62.3.50.33:8001
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (Linux; U; Android 4.
Requête brute (extrait)
POST /api HTTP/1.1 Host: 62.3.50.33:8001 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30 Accept-Encoding: gzip, de
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "22d9380abcdf97c82db21728e444020cf16735ea",
"http_host_hash": "29d114ae8a3567c5f1863f5bd79c5d398a432fe8",
"http_target_hash": "ada91241341ae792ecf0a59cad28616a77bab856",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 961,
"payload_entropy": 5.683071852625628,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 8001,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 3.5,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 72,
"tag_count": 14,
"anomaly_count": 0,
"campaign_key": "4233215eac428c6aa6ff3045dad8e6b36c355d4e",
"event_fingerprint": "753d737f3424e15f5caa9352f15846ae687f62ee",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "6c8160595869adea51d6742918f57fdf",
"payload_hash": "8108cf2dd523e1fa122bf7187aa7f58b",
"path_pattern_hash": "702acf7c08d3b03b321d97b4903ad221"
},
"target_context": {
"dst_port": 8001,
"service": "http",
"service_name": "http",
"risk_score": 72
},
"payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.",
"method": "POST",
"path": "\/api",
"user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api HTTP\/1.1",
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30\r\nAccept-Encoding: gzip, de",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.",
"evidence": {
"method": "POST",
"path": "\/api",
"user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api HTTP\/1.1",
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30\r\nAccept-Encoding: gzip, de",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "595ad964b587eac99d30ce57adac72fc0c616826",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api",
"request_line": "POST \/api HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.\u2026",
"port": 8001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
"target_port_label": "8001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 72\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 72,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8001,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api",
"request_line": "POST \/api HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.\u2026",
"port": 8001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.",
"target_port_label": "8001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8001"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api",
"http_contenttype_attack_surface",
"http_probe_api",
"http_prototype_pollution",
"http_ssti",
"net_web_probe"
]
}
16/07/2026 08:58:58 UTC
TCP
8001 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:8001 · (tentative d'exploit) · → /_next/server
Élevée
Élevé · 72
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /_next/server UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
58
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/_next/server
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8001
Chemin / cible
/_next/server
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 72
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /_next/server HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /_next/server HTTP/1.1
Host: 62.3.50.33:8001
Content-Length: 517
Connection: close
User-Agent: Mozilla/5.0 (Windows NT
Requête brute (extrait)
POST /_next/server HTTP/1.1 Host: 62.3.50.33:8001 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0 Accept-Encoding: gzip, de
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "a76e08b809549a8ef70acaf7074b5caa8a051858",
"http_host_hash": "29d114ae8a3567c5f1863f5bd79c5d398a432fe8",
"http_target_hash": "bef481449499f499a0b29ed75c9630076205b04f",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 960,
"payload_entropy": 5.644961479242396,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 8001,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 3.5,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 72,
"tag_count": 13,
"anomaly_count": 0,
"campaign_key": "4782cb8aee6fd0e6c4c55b5d975eafaf362cb4b1",
"event_fingerprint": "bf96ba395752606c01a64194c022baae726932d3",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "64a32e80cd1b4b7b1af4cc78f58848ee",
"payload_hash": "e52922bee3e30fc7381ed38e67407f13",
"path_pattern_hash": "4d9c4ca8a8065d3ce7073b6b23f61056"
},
"target_context": {
"dst_port": 8001,
"service": "http",
"service_name": "http",
"risk_score": 72
},
"payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT ",
"method": "POST",
"path": "\/_next\/server",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next\/server HTTP\/1.1",
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0\r\nAccept-Encoding: gzip, de",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT",
"evidence": {
"method": "POST",
"path": "\/_next\/server",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next\/server HTTP\/1.1",
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0\r\nAccept-Encoding: gzip, de",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "412ae60cc2c65143d950016c6429db8c117f1ab0",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next\/server",
"request_line": "POST \/_next\/server HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134\u2026",
"port": 8001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
"target_port_label": "8001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 72\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 72,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8001,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next\/server",
"request_line": "POST \/_next\/server HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134\u2026",
"port": 8001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT",
"target_port_label": "8001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8001"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti",
"net_web_probe"
]
}
16/07/2026 08:58:57 UTC
TCP
8001 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:8001 · (tentative d'exploit) · → /_next
Élevée
Élevé · 72
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /_next UA Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWeb…
Émulateur
HTTP
WAF
52
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/_next
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8001
Chemin / cible
/_next
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 72
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /_next HTTP/1.1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/134.0.6998.99 Mobile/15E148 Safari/604.1
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /_next HTTP/1.1
Host: 62.3.50.33:8001
Content-Length: 522
Connection: close
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone
Requête brute (extrait)
POST /_next HTTP/1.1 Host: 62.3.50.33:8001 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/134.0.6998.99 Mobile/15E148 Safari/604.1 Accept-Encoding
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "affd667937319ba36aa098ac5e3b53f4e282c1fe",
"http_host_hash": "29d114ae8a3567c5f1863f5bd79c5d398a432fe8",
"http_target_hash": "afd9bdeafd8c657f6b493ada03c51e348516227b",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 977,
"payload_entropy": 5.677692302911675,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 8001,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 3.5,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 72,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "c8c3fc385382ab9e7d62a5bf704b712a07bf4921",
"event_fingerprint": "b7972a9f6ff0544bd5c94f027bcd7000ce37917a",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "6990db627a3d5a6ae3f8a2c22924225b",
"payload_hash": "ee47e3d70f81fac2fb679f4d2502f560",
"path_pattern_hash": "bfd33612e3863357684bd23d10455a76"
},
"target_context": {
"dst_port": 8001,
"service": "http",
"service_name": "http",
"risk_score": 72
},
"payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone",
"method": "POST",
"path": "\/_next",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next HTTP\/1.1",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1\r\nAccept-Encoding",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone",
"evidence": {
"method": "POST",
"path": "\/_next",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next HTTP\/1.1",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1\r\nAccept-Encoding",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0107e3999b631c82f57df775b7cc61705d7bebee",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next",
"request_line": "POST \/_next HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mob\u2026",
"port": 8001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
"target_port_label": "8001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 72\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 72,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8001,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next",
"request_line": "POST \/_next HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mob\u2026",
"port": 8001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone",
"target_port_label": "8001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8001"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti",
"net_web_probe"
]
}
16/07/2026 08:58:55 UTC
TCP
8001 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:8001 · (tentative d'exploit)
Élevée
Élevé · 72
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST / UA Mozilla/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build/…
Émulateur
HTTP
WAF
55
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8001
Chemin / cible
/
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 72
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST / HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
sap-sapcontrol-path
Payload (extrait)
POST / HTTP/1.1
Host: 62.3.50.33:8001
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2
Requête brute (extrait)
POST / HTTP/1.1 Host: 62.3.50.33:8001 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30 Accept-Encoding: gzip, defla
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "22d9380abcdf97c82db21728e444020cf16735ea",
"http_host_hash": "29d114ae8a3567c5f1863f5bd79c5d398a432fe8",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 958,
"payload_entropy": 5.6750249125013,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 8001,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 3.5,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 72,
"tag_count": 13,
"anomaly_count": 0,
"campaign_key": "0dcdef1890affd23fcfe27214599932b827f0454",
"event_fingerprint": "ad837306fae4f5f939764b88d198c1cda2f84fb1",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "6c8160595869adea51d6742918f57fdf",
"payload_hash": "232d5fc36448ae549dcb2e4489cb8ef5",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8001,
"service": "http",
"service_name": "http",
"risk_score": 72
},
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2",
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30\r\nAccept-Encoding: gzip, defla",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2",
"evidence": {
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30\r\nAccept-Encoding: gzip, defla",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8c7d21cef64d8235c7a654606a73512a697656e8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.\u2026",
"port": 8001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8001 \u00b7 (tentative d'exploit)",
"target_port_label": "8001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 72\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 72,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8001,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.\u2026",
"port": 8001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8001 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2",
"target_port_label": "8001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8001"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti",
"net_web_probe"
]
}
16/07/2026 08:58:54 UTC
TCP
8001 · HTTP ALT 8001
http-alt-8001
http-alt-8001 · via HTTP ALT 8001:8001 · (sonde / probe)
Faible
Faible · 0
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
HTTP-ALT-8001
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8001
Chemin / cible
—
Pourquoi cette classification : Type « http-alt-8001 » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 0
Confiance : Confiance faible (0 %) — classification prudente
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http-alt-8001",
"app_proto": "http-alt-8001",
"asn": 49870,
"country": "SC",
"dst_port": 8001,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 0.5,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 0,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "e1b4b218a2ce3255af287d227584f045b97adf65",
"event_fingerprint": "049aef23df13456d89de208b1ad1953cb38ace86",
"classification_reason": "Type \u00ab http-alt-8001 \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"named_classification_skipped": false,
"service_name": "http-alt-8001",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "9c5260292de253ed938f4ca5928a2933"
},
"target_context": {
"dst_port": 8001,
"service": "http-alt-8001",
"service_name": "http-alt-8001",
"risk_score": 0
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "74387838a986846c7ad6ad3f688dc566b7b6a4cb",
"protocol_details": {
"port": 8001,
"service": "http-alt-8001",
"service_label_fr": "HTTP ALT 8001"
},
"attack_vector": "http-alt-8001 \u00b7 via HTTP ALT 8001:8001 \u00b7 (sonde \/ probe)",
"target_port_label": "8001 \u00b7 HTTP ALT 8001",
"emulator_service": "http-alt-8001",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http-alt-8001 \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab http-alt-8001 \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 0,
"risk_label": "Faible",
"service_name": "http-alt-8001",
"service_label_fr": "HTTP ALT 8001",
"dst_port": 8001,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http-alt-8001",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 8001,
"service": "http-alt-8001",
"service_label_fr": "HTTP ALT 8001"
},
"attack_vector": "http-alt-8001 \u00b7 via HTTP ALT 8001:8001 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "8001 \u00b7 HTTP ALT 8001",
"emulator_service": "http-alt-8001",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http_alt_8001",
"service_banner": "honeypot-http-alt-8001",
"service_os": "linux",
"dst_port": "8001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
16/07/2026 08:52:12 UTC
TCP
3005 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:3005 · (tentative d'exploit) · → /app
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /app UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100…
Émulateur
HTTP
WAF
52
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/app
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
3005
Chemin / cible
/app
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /app HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136.
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /app HTTP/1.1
Host: 62.3.50.33:3005
Content-Length: 522
Connection: close
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win
Requête brute (extrait)
POST /app HTTP/1.1 Host: 62.3.50.33:3005 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136. Accept-Encoding: gzip, deflate Next-Action: x X-Nextjs-Request-Id: poop1234 C
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "fac64969f9eca34262c56352be2d62dd2d22b1a0",
"http_host_hash": "99e2017216b0aba2a9ba1647c3ed96d0b53169da",
"http_target_hash": "0c35eebf403cf91fe77a64921d76aa1ca6411d20",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 912,
"payload_entropy": 5.630352465896633,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 3005,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 7.6,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 11,
"anomaly_count": 0,
"campaign_key": "409d79945ac69f12b27c5227038c4590dd3a2435",
"event_fingerprint": "eb9da4b6cec1f2fab2354c18049289346fb9c77e",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "9f10b48170735feac18b44fa385fef37",
"payload_hash": "c0c9e8da8e7b669b7da9dcd1df035c36",
"path_pattern_hash": "f53b52ad6d21cceb72dfa78fb67614fe"
},
"target_context": {
"dst_port": 3005,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3005\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"method": "POST",
"path": "\/app",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/app HTTP\/1.1",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3005\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-Request-Id: poop1234\r\nC",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3005\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"evidence": {
"method": "POST",
"path": "\/app",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/app HTTP\/1.1",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3005\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-Request-Id: poop1234\r\nC",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3005\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2215fe4055f28b45ee1749bed193b0dd1c773f27",
"protocol_details": {
"http_method": "POST",
"http_path": "\/app",
"request_line": "POST \/app HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
"port": 3005,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3005\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"attack_vector": "http smuggling probe \u00b7 via HTTP:3005 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
"target_port_label": "3005 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3005,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/app",
"request_line": "POST \/app HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
"port": 3005,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:3005 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3005\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"target_port_label": "3005 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3005"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:3005"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
16/07/2026 08:52:12 UTC
TCP
3005 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:3005 · (tentative d'exploit) · → /api/route
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/route UA Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KH…
Émulateur
HTTP
WAF
62
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/api/route
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
3005
Chemin / cible
/api/route
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 10 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /api/route HTTP/1.1
User-Agent
Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
k8s-api
Payload (extrait)
POST /api/route HTTP/1.1
Host: 62.3.50.33:3005
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (X11; CrOS x86_
Requête brute (extrait)
POST /api/route HTTP/1.1 Host: 62.3.50.33:3005 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "d336075c3988c6b7205cebd57d13f49ace6a0b3b",
"http_host_hash": "99e2017216b0aba2a9ba1647c3ed96d0b53169da",
"http_target_hash": "1a9b2c3dbe8a713bfc0c240bb1a6ea2141b55601",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 943,
"payload_entropy": 5.649192346107601,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 3005,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 7.6,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 15,
"anomaly_count": 0,
"campaign_key": "67ee8846944230357a3f3dd914eebf93dced9a22",
"event_fingerprint": "52723f4f49b4a7ed8b17c85f3f09198708367ed6",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "5ea6889a59d080298a42c0e1b4758211",
"payload_hash": "50712b5f40a24d87f0745bfe3b4b4550",
"path_pattern_hash": "7c4fe35e07eebe8bea27a36c14378e32"
},
"target_context": {
"dst_port": 3005,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3005\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_",
"method": "POST",
"path": "\/api\/route",
"user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api\/route HTTP\/1.1",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3005\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3005\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_",
"evidence": {
"method": "POST",
"path": "\/api\/route",
"user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api\/route HTTP\/1.1",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3005\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3005\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "64bb525b3be8b5f979877e4a574d645d793f1371",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/route",
"request_line": "POST \/api\/route HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 3005,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3005\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_",
"attack_vector": "http smuggling probe \u00b7 via HTTP:3005 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
"target_port_label": "3005 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3005,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/route",
"request_line": "POST \/api\/route HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 3005,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:3005 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3005\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_",
"target_port_label": "3005 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 10 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3005"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:3005"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api",
"http_api_route_probe",
"http_contenttype_attack_surface",
"http_probe_api",
"http_prototype_pollution",
"http_ssti"
]
}
16/07/2026 08:52:11 UTC
TCP
3005 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:3005 · (tentative d'exploit) · → /_next/server
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /_next/server UA Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KH…
Émulateur
HTTP
WAF
58
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/_next/server
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
3005
Chemin / cible
/_next/server
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /_next/server HTTP/1.1
User-Agent
Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /_next/server HTTP/1.1
Host: 62.3.50.33:3005
Content-Length: 513
Connection: close
User-Agent: Mozilla/5.0 (X11; CrOS x
Requête brute (extrait)
POST /_next/server HTTP/1.1 Host: 62.3.50.33:3005 Content-Length: 513 Connection: close User-Agent: Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Act
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "d336075c3988c6b7205cebd57d13f49ace6a0b3b",
"http_host_hash": "99e2017216b0aba2a9ba1647c3ed96d0b53169da",
"http_target_hash": "bef481449499f499a0b29ed75c9630076205b04f",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 939,
"payload_entropy": 5.663076880957805,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 3005,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 7.6,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "5d25afb2945523ccf92f771fb4ebb7a164960671",
"event_fingerprint": "c52801bcd7a7e448b21481eaf8347cfd35c4eb80",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "5ea6889a59d080298a42c0e1b4758211",
"payload_hash": "7207b9503d2df121b7f218f294f4a360",
"path_pattern_hash": "4d9c4ca8a8065d3ce7073b6b23f61056"
},
"target_context": {
"dst_port": 3005,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3005\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x",
"method": "POST",
"path": "\/_next\/server",
"user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next\/server HTTP\/1.1",
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3005\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Act",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3005\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x",
"evidence": {
"method": "POST",
"path": "\/_next\/server",
"user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next\/server HTTP\/1.1",
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3005\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Act",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3005\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ce5c98e558a33031ea457073d956db63ab3014ac",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next\/server",
"request_line": "POST \/_next\/server HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 3005,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3005\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x",
"attack_vector": "http smuggling probe \u00b7 via HTTP:3005 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
"target_port_label": "3005 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3005,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next\/server",
"request_line": "POST \/_next\/server HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 3005,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:3005 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3005\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x",
"target_port_label": "3005 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3005"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:3005"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
16/07/2026 08:52:10 UTC
TCP
3005 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:3005 · (tentative d'exploit) · → /api
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
56
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/api
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
3005
Chemin / cible
/api
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /api HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
k8s-api
Payload (extrait)
POST /api HTTP/1.1
Host: 62.3.50.33:3005
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac
Requête brute (extrait)
POST /api HTTP/1.1 Host: 62.3.50.33:3005 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Actio
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "8447a2dfcfbbdcc75d5b5272da958411ec73dd1a",
"http_host_hash": "99e2017216b0aba2a9ba1647c3ed96d0b53169da",
"http_target_hash": "ada91241341ae792ecf0a59cad28616a77bab856",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 944,
"payload_entropy": 5.654100086194772,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 3005,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 7.6,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 13,
"anomaly_count": 0,
"campaign_key": "e87e0a03fa7675883ec1012a6ebc72fb05416a50",
"event_fingerprint": "7b78d908f30761ab7a1c2c17b7b687005883e8cf",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "93af66442f9c9958e5fcc0142d9e74de",
"payload_hash": "1dae4334f48fbcf3b26fdf9e228b0566",
"path_pattern_hash": "702acf7c08d3b03b321d97b4903ad221"
},
"target_context": {
"dst_port": 3005,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3005\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"method": "POST",
"path": "\/api",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api HTTP\/1.1",
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3005\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Actio",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3005\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"evidence": {
"method": "POST",
"path": "\/api",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api HTTP\/1.1",
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3005\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Actio",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3005\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2fad6643853933a60dded508605d2d9b6683ddfc",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api",
"request_line": "POST \/api HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 3005,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3005\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"attack_vector": "http smuggling probe \u00b7 via HTTP:3005 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
"target_port_label": "3005 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3005,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api",
"request_line": "POST \/api HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 3005,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:3005 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3005\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"target_port_label": "3005 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3005"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:3005"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api",
"http_contenttype_attack_surface",
"http_probe_api",
"http_prototype_pollution",
"http_ssti"
]
}
16/07/2026 08:52:08 UTC
TCP
3005 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:3005 · (tentative d'exploit) · → /_next
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /_next UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
52
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/_next
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
3005
Chemin / cible
/_next
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /_next HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /_next HTTP/1.1
Host: 62.3.50.33:3005
Content-Length: 517
Connection: close
User-Agent: Mozilla/5.0 (Windows NT 10.0; W
Requête brute (extrait)
POST /_next HTTP/1.1 Host: 62.3.50.33:3005 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0 Accept-Encoding: gzip, deflate
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "a76e08b809549a8ef70acaf7074b5caa8a051858",
"http_host_hash": "99e2017216b0aba2a9ba1647c3ed96d0b53169da",
"http_target_hash": "afd9bdeafd8c657f6b493ada03c51e348516227b",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 953,
"payload_entropy": 5.66024373867445,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 3005,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 7.6,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 11,
"anomaly_count": 0,
"campaign_key": "409d79945ac69f12b27c5227038c4590dd3a2435",
"event_fingerprint": "38ad2cce917d063b17badc660b2a9592d757ef86",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "64a32e80cd1b4b7b1af4cc78f58848ee",
"payload_hash": "78d62da5cafe4ff4a161eded2699e682",
"path_pattern_hash": "bfd33612e3863357684bd23d10455a76"
},
"target_context": {
"dst_port": 3005,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3005\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"method": "POST",
"path": "\/_next",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next HTTP\/1.1",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3005\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0\r\nAccept-Encoding: gzip, deflate\r\n",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3005\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"evidence": {
"method": "POST",
"path": "\/_next",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next HTTP\/1.1",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3005\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0\r\nAccept-Encoding: gzip, deflate\r\n",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3005\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "77ced502d4999be0bf1b28c1f6280eab7f2db10b",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next",
"request_line": "POST \/_next HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134\u2026",
"port": 3005,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3005\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"attack_vector": "http smuggling probe \u00b7 via HTTP:3005 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
"target_port_label": "3005 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3005,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next",
"request_line": "POST \/_next HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134\u2026",
"port": 3005,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:3005 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3005\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"target_port_label": "3005 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3005"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:3005"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
16/07/2026 08:52:07 UTC
TCP
3005
—
Sonde port
Sonde port · port 3005 · (sonde / probe)
Faible
Moyen · 44
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
3005
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": null,
"app_proto": null,
"asn": 49870,
"country": "SC",
"dst_port": 3005,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "ce50fefe174c2345fa5d9fa9cff7e9df521ee4f6",
"event_fingerprint": "eb9a8bca52e05aee8faa343a31a8940b297251a9",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 3005,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cf32c8bc9ef0cea45e7a23831344ded9f5b745bc",
"protocol_details": {
"port": 3005
},
"attack_vector": "Sonde port \u00b7 port 3005 \u00b7 (sonde \/ probe)",
"target_port_label": "3005",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 3005,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"port": 3005
},
"attack_vector": "Sonde port \u00b7 port 3005 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "3005",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "3005"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
16/07/2026 08:52:07 UTC
TCP
3005 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:3005 · (tentative d'exploit)
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST / UA Mozilla/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build/…
Émulateur
HTTP
WAF
55
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
3005
Chemin / cible
/
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST / HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
sap-sapcontrol-path
Payload (extrait)
POST / HTTP/1.1
Host: 62.3.50.33:3005
Content-Length: 522
Connection: close
User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2
Requête brute (extrait)
POST / HTTP/1.1 Host: 62.3.50.33:3005 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30 Accept-Encoding: gzip, defla
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "22d9380abcdf97c82db21728e444020cf16735ea",
"http_host_hash": "99e2017216b0aba2a9ba1647c3ed96d0b53169da",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 964,
"payload_entropy": 5.677883372295552,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 3005,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 7.6,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "6fbc36c023681adf3f3ed30c0d6790ad01fb293d",
"event_fingerprint": "111f2916e06a6dac5fed100ef04e5d8fb863e3c0",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "6c8160595869adea51d6742918f57fdf",
"payload_hash": "65c45de4d89d8f373ba49da4e1edcffb",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 3005,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3005\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2",
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3005\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30\r\nAccept-Encoding: gzip, defla",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3005\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2",
"evidence": {
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3005\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30\r\nAccept-Encoding: gzip, defla",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3005\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1f7b30701401ff11cb2f6be759d5eaace27d2d68",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.\u2026",
"port": 3005,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3005\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2",
"attack_vector": "http smuggling probe \u00b7 via HTTP:3005 \u00b7 (tentative d'exploit)",
"target_port_label": "3005 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3005,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.\u2026",
"port": 3005,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:3005 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3005\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2",
"target_port_label": "3005 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3005"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:3005"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
16/07/2026 08:15:08 UTC
TCP
5000 · FLASK HTTP
Sonde HTTP
Sonde HTTP · via FLASK HTTP:5000 · (sonde / probe)
Élevée
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
FLASK-HTTP
WAF
—
Recommandation
Surveiller
Tags
flask_http_emulated
net_web_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5000
Chemin / cible
—
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 71%
Confiance classification
71%
Risque capteur
Moyen
· 40
Confiance : Confiance 71 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765726b7a6575672f332e302e3120507974686f6e2f332e31320d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c21646f63747970652068746d6c3e3c7469746c653e466c61736b3c",
"emulator_response_len": 158,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "flask-http",
"app_proto": "flask-http",
"asn": 49870,
"country": "SC",
"dst_port": 5000,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.1,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 40,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "3eec9fba1e23cfd0abfb45632b14240dd83be731",
"event_fingerprint": "ca12ac856c9aabb53943b247ec13e1d2f927b610",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "4154520a4208b3f021f35a6cc1dd98ae"
},
"service_name": "flask-http",
"target_context": {
"dst_port": 5000,
"service": "flask-http",
"service_name": "flask-http",
"risk_score": 40
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 71%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.71,
"classification_confidence": 0.71,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4a2f14d6234690f650e959209b96d8a6ff0e47f3",
"protocol_details": {
"port": 5000,
"service": "flask-http",
"service_label_fr": "FLASK HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via FLASK HTTP:5000 \u00b7 (sonde \/ probe)",
"target_port_label": "5000 \u00b7 FLASK HTTP",
"emulator_service": "flask-http",
"confidence_reason": "Confiance 71 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 71%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 71%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 71,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "flask-http",
"service_label_fr": "FLASK HTTP",
"dst_port": 5000,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-flask-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 5000,
"service": "flask-http",
"service_label_fr": "FLASK HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via FLASK HTTP:5000 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "5000 \u00b7 FLASK HTTP",
"emulator_service": "flask-http",
"confidence_reason": "Confiance 71 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 71 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "flask_http",
"service_banner": "honeypot-flask-http",
"service_os": "linux",
"dst_port": "5000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"flask_http_emulated",
"net_web_probe"
]
}
16/07/2026 08:15:00 UTC
TCP
5000 · FLASK HTTP
Sonde HTTP
Sonde HTTP · via FLASK HTTP:5000 · (sonde / probe)
Élevée
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
FLASK-HTTP
WAF
—
Recommandation
Surveiller
Tags
flask_http_emulated
net_web_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5000
Chemin / cible
—
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 71%
Confiance classification
71%
Risque capteur
Moyen
· 40
Confiance : Confiance 71 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765726b7a6575672f332e302e3120507974686f6e2f332e31320d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c21646f63747970652068746d6c3e3c7469746c653e466c61736b3c",
"emulator_response_len": 158,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "flask-http",
"app_proto": "flask-http",
"asn": 49870,
"country": "SC",
"dst_port": 5000,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.1,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 40,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "3eec9fba1e23cfd0abfb45632b14240dd83be731",
"event_fingerprint": "ca12ac856c9aabb53943b247ec13e1d2f927b610",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "4154520a4208b3f021f35a6cc1dd98ae"
},
"service_name": "flask-http",
"target_context": {
"dst_port": 5000,
"service": "flask-http",
"service_name": "flask-http",
"risk_score": 40
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 71%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.71,
"classification_confidence": 0.71,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4a2f14d6234690f650e959209b96d8a6ff0e47f3",
"protocol_details": {
"port": 5000,
"service": "flask-http",
"service_label_fr": "FLASK HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via FLASK HTTP:5000 \u00b7 (sonde \/ probe)",
"target_port_label": "5000 \u00b7 FLASK HTTP",
"emulator_service": "flask-http",
"confidence_reason": "Confiance 71 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 71%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 71%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 71,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "flask-http",
"service_label_fr": "FLASK HTTP",
"dst_port": 5000,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-flask-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 5000,
"service": "flask-http",
"service_label_fr": "FLASK HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via FLASK HTTP:5000 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "5000 \u00b7 FLASK HTTP",
"emulator_service": "flask-http",
"confidence_reason": "Confiance 71 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 71 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "flask_http",
"service_banner": "honeypot-flask-http",
"service_os": "linux",
"dst_port": "5000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"flask_http_emulated",
"net_web_probe"
]
}
16/07/2026 08:14:53 UTC
TCP
5000 · FLASK HTTP
Sonde HTTP
Sonde HTTP · via FLASK HTTP:5000 · (sonde / probe)
Élevée
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
FLASK-HTTP
WAF
—
Recommandation
Surveiller
Tags
flask_http_emulated
net_web_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5000
Chemin / cible
—
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 71%
Confiance classification
71%
Risque capteur
Moyen
· 40
Confiance : Confiance 71 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765726b7a6575672f332e302e3120507974686f6e2f332e31320d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c21646f63747970652068746d6c3e3c7469746c653e466c61736b3c",
"emulator_response_len": 158,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "flask-http",
"app_proto": "flask-http",
"asn": 49870,
"country": "SC",
"dst_port": 5000,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.1,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 40,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "3eec9fba1e23cfd0abfb45632b14240dd83be731",
"event_fingerprint": "ca12ac856c9aabb53943b247ec13e1d2f927b610",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "4154520a4208b3f021f35a6cc1dd98ae"
},
"service_name": "flask-http",
"target_context": {
"dst_port": 5000,
"service": "flask-http",
"service_name": "flask-http",
"risk_score": 40
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 71%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.71,
"classification_confidence": 0.71,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4a2f14d6234690f650e959209b96d8a6ff0e47f3",
"protocol_details": {
"port": 5000,
"service": "flask-http",
"service_label_fr": "FLASK HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via FLASK HTTP:5000 \u00b7 (sonde \/ probe)",
"target_port_label": "5000 \u00b7 FLASK HTTP",
"emulator_service": "flask-http",
"confidence_reason": "Confiance 71 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 71%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 71%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 71,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "flask-http",
"service_label_fr": "FLASK HTTP",
"dst_port": 5000,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-flask-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 5000,
"service": "flask-http",
"service_label_fr": "FLASK HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via FLASK HTTP:5000 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "5000 \u00b7 FLASK HTTP",
"emulator_service": "flask-http",
"confidence_reason": "Confiance 71 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 71 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "flask_http",
"service_banner": "honeypot-flask-http",
"service_os": "linux",
"dst_port": "5000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"flask_http_emulated",
"net_web_probe"
]
}
16/07/2026 08:14:47 UTC
TCP
5000 · FLASK HTTP
Sonde HTTP
Sonde HTTP · via FLASK HTTP:5000 · (sonde / probe)
Élevée
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
FLASK-HTTP
WAF
—
Recommandation
Surveiller
Tags
flask_http_emulated
net_web_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5000
Chemin / cible
—
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 71%
Confiance classification
71%
Risque capteur
Moyen
· 40
Confiance : Confiance 71 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765726b7a6575672f332e302e3120507974686f6e2f332e31320d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c21646f63747970652068746d6c3e3c7469746c653e466c61736b3c",
"emulator_response_len": 158,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "flask-http",
"app_proto": "flask-http",
"asn": 49870,
"country": "SC",
"dst_port": 5000,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.1,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 40,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "3eec9fba1e23cfd0abfb45632b14240dd83be731",
"event_fingerprint": "ca12ac856c9aabb53943b247ec13e1d2f927b610",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "4154520a4208b3f021f35a6cc1dd98ae"
},
"service_name": "flask-http",
"target_context": {
"dst_port": 5000,
"service": "flask-http",
"service_name": "flask-http",
"risk_score": 40
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 71%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.71,
"classification_confidence": 0.71,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4a2f14d6234690f650e959209b96d8a6ff0e47f3",
"protocol_details": {
"port": 5000,
"service": "flask-http",
"service_label_fr": "FLASK HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via FLASK HTTP:5000 \u00b7 (sonde \/ probe)",
"target_port_label": "5000 \u00b7 FLASK HTTP",
"emulator_service": "flask-http",
"confidence_reason": "Confiance 71 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 71%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 71%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 71,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "flask-http",
"service_label_fr": "FLASK HTTP",
"dst_port": 5000,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-flask-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 5000,
"service": "flask-http",
"service_label_fr": "FLASK HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via FLASK HTTP:5000 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "5000 \u00b7 FLASK HTTP",
"emulator_service": "flask-http",
"confidence_reason": "Confiance 71 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 71 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "flask_http",
"service_banner": "honeypot-flask-http",
"service_os": "linux",
"dst_port": "5000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"flask_http_emulated",
"net_web_probe"
]
}
16/07/2026 08:14:41 UTC
TCP
5000 · FLASK HTTP
Sonde HTTP
Sonde HTTP · via FLASK HTTP:5000 · (sonde / probe)
Élevée
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
FLASK-HTTP
WAF
—
Recommandation
Surveiller
Tags
flask_http_emulated
net_web_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5000
Chemin / cible
—
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 71%
Confiance classification
71%
Risque capteur
Moyen
· 40
Confiance : Confiance 71 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765726b7a6575672f332e302e3120507974686f6e2f332e31320d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c21646f63747970652068746d6c3e3c7469746c653e466c61736b3c",
"emulator_response_len": 158,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "flask-http",
"app_proto": "flask-http",
"asn": 49870,
"country": "SC",
"dst_port": 5000,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.1,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 40,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "3eec9fba1e23cfd0abfb45632b14240dd83be731",
"event_fingerprint": "ca12ac856c9aabb53943b247ec13e1d2f927b610",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "4154520a4208b3f021f35a6cc1dd98ae"
},
"service_name": "flask-http",
"target_context": {
"dst_port": 5000,
"service": "flask-http",
"service_name": "flask-http",
"risk_score": 40
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 71%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.71,
"classification_confidence": 0.71,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4a2f14d6234690f650e959209b96d8a6ff0e47f3",
"protocol_details": {
"port": 5000,
"service": "flask-http",
"service_label_fr": "FLASK HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via FLASK HTTP:5000 \u00b7 (sonde \/ probe)",
"target_port_label": "5000 \u00b7 FLASK HTTP",
"emulator_service": "flask-http",
"confidence_reason": "Confiance 71 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 71%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 71%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 71,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "flask-http",
"service_label_fr": "FLASK HTTP",
"dst_port": 5000,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-flask-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 5000,
"service": "flask-http",
"service_label_fr": "FLASK HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via FLASK HTTP:5000 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "5000 \u00b7 FLASK HTTP",
"emulator_service": "flask-http",
"confidence_reason": "Confiance 71 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 71 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "flask_http",
"service_banner": "honeypot-flask-http",
"service_os": "linux",
"dst_port": "5000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"flask_http_emulated",
"net_web_probe"
]
}
16/07/2026 08:14:33 UTC
TCP
5000 · FLASK HTTP
Sonde HTTP
Sonde HTTP · via FLASK HTTP:5000 · (sonde / probe)
Élevée
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
FLASK-HTTP
WAF
—
Recommandation
Surveiller
Tags
flask_http_emulated
net_web_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5000
Chemin / cible
—
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 71%
Confiance classification
71%
Risque capteur
Moyen
· 40
Confiance : Confiance 71 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765726b7a6575672f332e302e3120507974686f6e2f332e31320d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c21646f63747970652068746d6c3e3c7469746c653e466c61736b3c",
"emulator_response_len": 158,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "flask-http",
"app_proto": "flask-http",
"asn": 49870,
"country": "SC",
"dst_port": 5000,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.1,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 40,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "3eec9fba1e23cfd0abfb45632b14240dd83be731",
"event_fingerprint": "ca12ac856c9aabb53943b247ec13e1d2f927b610",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "4154520a4208b3f021f35a6cc1dd98ae"
},
"service_name": "flask-http",
"target_context": {
"dst_port": 5000,
"service": "flask-http",
"service_name": "flask-http",
"risk_score": 40
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 71%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.71,
"classification_confidence": 0.71,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4a2f14d6234690f650e959209b96d8a6ff0e47f3",
"protocol_details": {
"port": 5000,
"service": "flask-http",
"service_label_fr": "FLASK HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via FLASK HTTP:5000 \u00b7 (sonde \/ probe)",
"target_port_label": "5000 \u00b7 FLASK HTTP",
"emulator_service": "flask-http",
"confidence_reason": "Confiance 71 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 71%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 71%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 71,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "flask-http",
"service_label_fr": "FLASK HTTP",
"dst_port": 5000,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-flask-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 5000,
"service": "flask-http",
"service_label_fr": "FLASK HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via FLASK HTTP:5000 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "5000 \u00b7 FLASK HTTP",
"emulator_service": "flask-http",
"confidence_reason": "Confiance 71 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 71 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "flask_http",
"service_banner": "honeypot-flask-http",
"service_os": "linux",
"dst_port": "5000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"flask_http_emulated",
"net_web_probe"
]
}
16/07/2026 08:14:26 UTC
TCP
5000 · FLASK HTTP
Sonde HTTP
Sonde HTTP · via FLASK HTTP:5000 · (sonde / probe)
Élevée
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
FLASK-HTTP
WAF
—
Recommandation
Surveiller
Tags
flask_http_emulated
net_web_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5000
Chemin / cible
—
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 71%
Confiance classification
71%
Risque capteur
Moyen
· 40
Confiance : Confiance 71 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765726b7a6575672f332e302e3120507974686f6e2f332e31320d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c21646f63747970652068746d6c3e3c7469746c653e466c61736b3c",
"emulator_response_len": 158,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "flask-http",
"app_proto": "flask-http",
"asn": 49870,
"country": "SC",
"dst_port": 5000,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.1,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 40,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "3eec9fba1e23cfd0abfb45632b14240dd83be731",
"event_fingerprint": "ca12ac856c9aabb53943b247ec13e1d2f927b610",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "4154520a4208b3f021f35a6cc1dd98ae"
},
"service_name": "flask-http",
"target_context": {
"dst_port": 5000,
"service": "flask-http",
"service_name": "flask-http",
"risk_score": 40
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 71%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.71,
"classification_confidence": 0.71,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4a2f14d6234690f650e959209b96d8a6ff0e47f3",
"protocol_details": {
"port": 5000,
"service": "flask-http",
"service_label_fr": "FLASK HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via FLASK HTTP:5000 \u00b7 (sonde \/ probe)",
"target_port_label": "5000 \u00b7 FLASK HTTP",
"emulator_service": "flask-http",
"confidence_reason": "Confiance 71 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 71%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 71%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 71,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "flask-http",
"service_label_fr": "FLASK HTTP",
"dst_port": 5000,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-flask-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 5000,
"service": "flask-http",
"service_label_fr": "FLASK HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via FLASK HTTP:5000 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "5000 \u00b7 FLASK HTTP",
"emulator_service": "flask-http",
"confidence_reason": "Confiance 71 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 71 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "flask_http",
"service_banner": "honeypot-flask-http",
"service_os": "linux",
"dst_port": "5000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"flask_http_emulated",
"net_web_probe"
]
}
16/07/2026 07:34:21 UTC
TCP
5055 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:5055 · (tentative d'exploit) · → /app
Élevée
Élevé · 71
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /app UA Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KH…
Émulateur
HTTP
WAF
52
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/app
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
5055
Chemin / cible
/app
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 71
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /app HTTP/1.1
User-Agent
Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /app HTTP/1.1
Host: 62.3.50.33:5055
Content-Length: 522
Connection: close
User-Agent: Mozilla/5.0 (X11; CrOS x86_64 145
Requête brute (extrait)
POST /app HTTP/1.1 Host: 62.3.50.33:5055 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: x X
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "d336075c3988c6b7205cebd57d13f49ace6a0b3b",
"http_host_hash": "6ac02e4ee4189a7cdc848a13485bfd335176ac45",
"http_target_hash": "0c35eebf403cf91fe77a64921d76aa1ca6411d20",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 943,
"payload_entropy": 5.640278590940503,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 5055,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 71,
"tag_count": 11,
"anomaly_count": 0,
"campaign_key": "c532e969e3894fa819805f164b44d4c8575b690b",
"event_fingerprint": "8059a3b8d6e97098499c09538faba8a7f4ccbda9",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 71,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "5ea6889a59d080298a42c0e1b4758211",
"payload_hash": "1877ea3de97696b0ed7b16909cba83e5",
"path_pattern_hash": "f53b52ad6d21cceb72dfa78fb67614fe"
},
"target_context": {
"dst_port": 5055,
"service": "http",
"service_name": "http",
"risk_score": 71
},
"payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:5055\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145",
"method": "POST",
"path": "\/app",
"user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/app HTTP\/1.1",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:5055\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:5055\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145",
"evidence": {
"method": "POST",
"path": "\/app",
"user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/app HTTP\/1.1",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:5055\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:5055\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "de306e0c4fc98242c5da0706b36671fc45117c98",
"protocol_details": {
"http_method": "POST",
"http_path": "\/app",
"request_line": "POST \/app HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 5055,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:5055\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145",
"attack_vector": "http smuggling probe \u00b7 via HTTP:5055 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
"target_port_label": "5055 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 71\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 71,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 71,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5055,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/app",
"request_line": "POST \/app HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 5055,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:5055 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:5055\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145",
"target_port_label": "5055 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5055"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:5055"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
16/07/2026 07:34:21 UTC
TCP
5055 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:5055 · (tentative d'exploit) · → /api/route
Élevée
Élevé · 71
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/route UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
62
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/api/route
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
5055
Chemin / cible
/api/route
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 71
Confiance : Confiance 95 % — Motif catalogue confirmé · 10 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /api/route HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
k8s-api
Payload (extrait)
POST /api/route HTTP/1.1
Host: 62.3.50.33:5055
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (Windows NT 10.
Requête brute (extrait)
POST /api/route HTTP/1.1 Host: 62.3.50.33:5055 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0 Accept-Encoding: gzip, defla
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "a76e08b809549a8ef70acaf7074b5caa8a051858",
"http_host_hash": "6ac02e4ee4189a7cdc848a13485bfd335176ac45",
"http_target_hash": "1a9b2c3dbe8a713bfc0c240bb1a6ea2141b55601",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 958,
"payload_entropy": 5.672602131690977,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 5055,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 71,
"tag_count": 15,
"anomaly_count": 0,
"campaign_key": "56ae6fc1101ceb0f5c8f9161de0f3983171e51c4",
"event_fingerprint": "253c2d55744465225edc3d4e13f48cee5a1966bb",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 71,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "64a32e80cd1b4b7b1af4cc78f58848ee",
"payload_hash": "775bfd0392be08168130c9843bbd6b9f",
"path_pattern_hash": "7c4fe35e07eebe8bea27a36c14378e32"
},
"target_context": {
"dst_port": 5055,
"service": "http",
"service_name": "http",
"risk_score": 71
},
"payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:5055\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"method": "POST",
"path": "\/api\/route",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api\/route HTTP\/1.1",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:5055\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0\r\nAccept-Encoding: gzip, defla",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:5055\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"evidence": {
"method": "POST",
"path": "\/api\/route",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api\/route HTTP\/1.1",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:5055\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0\r\nAccept-Encoding: gzip, defla",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:5055\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b6e55e1d4de6317b5f1a1e3682f60194b4c60611",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/route",
"request_line": "POST \/api\/route HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134\u2026",
"port": 5055,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:5055\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"attack_vector": "http smuggling probe \u00b7 via HTTP:5055 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
"target_port_label": "5055 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 71\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 71,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 71,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5055,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/route",
"request_line": "POST \/api\/route HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134\u2026",
"port": 5055,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:5055 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:5055\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"target_port_label": "5055 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 10 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5055"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:5055"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api",
"http_api_route_probe",
"http_contenttype_attack_surface",
"http_probe_api",
"http_prototype_pollution",
"http_ssti"
]
}
16/07/2026 07:34:20 UTC
TCP
5055 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:5055 · (tentative d'exploit) · → /_next/server
Élevée
Élevé · 71
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /_next/server UA Mozilla/5.0 (Linux; Android 9; AFTWMST22 Build/PS7233; wv) Appl…
Émulateur
HTTP
WAF
58
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/_next/server
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
5055
Chemin / cible
/_next/server
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 71
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /_next/server HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 9; AFTWMST22 Build/PS7233; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/88.0.4324.152 Mobile Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /_next/server HTTP/1.1
Host: 62.3.50.33:5055
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (Linux; Andr
Requête brute (extrait)
POST /_next/server HTTP/1.1 Host: 62.3.50.33:5055 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 9; AFTWMST22 Build/PS7233; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/88.0.4324.152 Mobile Safari/537.36
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "1cafc1ec7983977ff1b9c77c60e09ef5fe869a95",
"http_host_hash": "6ac02e4ee4189a7cdc848a13485bfd335176ac45",
"http_target_hash": "bef481449499f499a0b29ed75c9630076205b04f",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 987,
"payload_entropy": 5.6661642921394915,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 5055,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 71,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "0d7447bb347afe5598a30d90482ecf57a4950100",
"event_fingerprint": "da859539650f8e4ef2736c15b99003b2f9b8edd0",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 71,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c772734c6eb2978096c283068906aec3",
"payload_hash": "cfdc790275c75ae022311ca4786fc0c2",
"path_pattern_hash": "4d9c4ca8a8065d3ce7073b6b23f61056"
},
"target_context": {
"dst_port": 5055,
"service": "http",
"service_name": "http",
"risk_score": 71
},
"payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:5055\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Andr",
"method": "POST",
"path": "\/_next\/server",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next\/server HTTP\/1.1",
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:5055\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36\r",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:5055\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Andr",
"evidence": {
"method": "POST",
"path": "\/_next\/server",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next\/server HTTP\/1.1",
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:5055\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36\r",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:5055\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Andr",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "facdff52807c33d3193bbd39774a1d80ba809639",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next\/server",
"request_line": "POST \/_next\/server HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88\u2026",
"port": 5055,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:5055\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Andr",
"attack_vector": "http smuggling probe \u00b7 via HTTP:5055 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
"target_port_label": "5055 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 71\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 71,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 71,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5055,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next\/server",
"request_line": "POST \/_next\/server HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88\u2026",
"port": 5055,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:5055 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:5055\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Andr",
"target_port_label": "5055 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5055"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:5055"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
16/07/2026 07:34:19 UTC
TCP
5055 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:5055 · (tentative d'exploit) · → /api
Élevée
Élevé · 71
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100…
Émulateur
HTTP
WAF
56
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/api
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
5055
Chemin / cible
/api
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 71
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /api HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136.
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
k8s-api
Payload (extrait)
POST /api HTTP/1.1
Host: 62.3.50.33:5055
Content-Length: 517
Connection: close
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win
Requête brute (extrait)
POST /api HTTP/1.1 Host: 62.3.50.33:5055 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136. Accept-Encoding: gzip, deflate Next-Action: x X-Nextjs-Request-Id: poop1234 C
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "fac64969f9eca34262c56352be2d62dd2d22b1a0",
"http_host_hash": "6ac02e4ee4189a7cdc848a13485bfd335176ac45",
"http_target_hash": "ada91241341ae792ecf0a59cad28616a77bab856",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 905,
"payload_entropy": 5.631640724739708,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 5055,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 71,
"tag_count": 13,
"anomaly_count": 0,
"campaign_key": "b2aa21004598ace8bb745b663e5d482951c9e328",
"event_fingerprint": "17aa731ddf590c6877efe19b63b484dca6861a64",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 71,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "9f10b48170735feac18b44fa385fef37",
"payload_hash": "c83bd37c5c015bb2a9783ceff1edf929",
"path_pattern_hash": "702acf7c08d3b03b321d97b4903ad221"
},
"target_context": {
"dst_port": 5055,
"service": "http",
"service_name": "http",
"risk_score": 71
},
"payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:5055\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"method": "POST",
"path": "\/api",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api HTTP\/1.1",
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:5055\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-Request-Id: poop1234\r\nC",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:5055\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"evidence": {
"method": "POST",
"path": "\/api",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api HTTP\/1.1",
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:5055\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-Request-Id: poop1234\r\nC",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:5055\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "47a9b4699a35544ebbbffe81cd0cc4a577a7ad96",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api",
"request_line": "POST \/api HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
"port": 5055,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:5055\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"attack_vector": "http smuggling probe \u00b7 via HTTP:5055 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
"target_port_label": "5055 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 71\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 71,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 71,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5055,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api",
"request_line": "POST \/api HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
"port": 5055,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:5055 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:5055\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"target_port_label": "5055 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5055"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:5055"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api",
"http_contenttype_attack_surface",
"http_probe_api",
"http_prototype_pollution",
"http_ssti"
]
}
16/07/2026 07:34:17 UTC
TCP
5055 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:5055 · (tentative d'exploit) · → /_next
Élevée
Élevé · 71
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /_next UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like…
Émulateur
HTTP
WAF
52
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/_next
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
5055
Chemin / cible
/_next
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 71
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /_next HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /_next HTTP/1.1
Host: 62.3.50.33:5055
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (X11; Linux x86_64)
Requête brute (extrait)
POST /_next HTTP/1.1 Host: 62.3.50.33:5055 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: x X-Nextjs
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "1c1f86ba252c0c8ebc250acab48718f12d6d1efd",
"http_host_hash": "6ac02e4ee4189a7cdc848a13485bfd335176ac45",
"http_target_hash": "afd9bdeafd8c657f6b493ada03c51e348516227b",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 930,
"payload_entropy": 5.625426777699496,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 5055,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 71,
"tag_count": 11,
"anomaly_count": 0,
"campaign_key": "c532e969e3894fa819805f164b44d4c8575b690b",
"event_fingerprint": "b9c30c24781ec277fce22650c260913b4288e815",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 71,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "72d43eb808798db218d063798749cc39",
"payload_hash": "4f25c148b3b27a50d86429eba33232a4",
"path_pattern_hash": "bfd33612e3863357684bd23d10455a76"
},
"target_context": {
"dst_port": 5055,
"service": "http",
"service_name": "http",
"risk_score": 71
},
"payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:5055\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64)",
"method": "POST",
"path": "\/_next",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next HTTP\/1.1",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:5055\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:5055\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64)",
"evidence": {
"method": "POST",
"path": "\/_next",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next HTTP\/1.1",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:5055\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:5055\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64)",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "41852c4948c45b860a641e646a2778c16269e8c5",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next",
"request_line": "POST \/_next HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 5055,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:5055\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64)",
"attack_vector": "http smuggling probe \u00b7 via HTTP:5055 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
"target_port_label": "5055 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 71\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 71,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 71,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5055,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next",
"request_line": "POST \/_next HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 5055,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:5055 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:5055\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64)",
"target_port_label": "5055 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5055"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:5055"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
16/07/2026 07:34:16 UTC
TCP
5055 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:5055 · (tentative d'exploit)
Élevée
Élevé · 71
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
55
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
5055
Chemin / cible
/
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 71
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST / HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
sap-sapcontrol-path
Payload (extrait)
POST / HTTP/1.1
Host: 62.3.50.33:5055
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64;
Requête brute (extrait)
POST / HTTP/1.1 Host: 62.3.50.33:5055 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0 Accept-Encoding: gzip, deflate Next-
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "a76e08b809549a8ef70acaf7074b5caa8a051858",
"http_host_hash": "6ac02e4ee4189a7cdc848a13485bfd335176ac45",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 949,
"payload_entropy": 5.656919544519872,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 5055,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 71,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "6be65b1484b2262c4097f96a6814b3ce1d2581b8",
"event_fingerprint": "5ef634d0ed2aeb079543c67bf9e67092e326e322",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 71,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "64a32e80cd1b4b7b1af4cc78f58848ee",
"payload_hash": "c0f10b7543726fc6d37023a99a6edcbf",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 5055,
"service": "http",
"service_name": "http",
"risk_score": 71
},
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:5055\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:5055\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nNext-",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:5055\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"evidence": {
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:5055\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nNext-",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:5055\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ac430826bb096911c902f90880bfc8e3422d0b5b",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134\u2026",
"port": 5055,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:5055\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"attack_vector": "http smuggling probe \u00b7 via HTTP:5055 \u00b7 (tentative d'exploit)",
"target_port_label": "5055 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 71\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 71,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 71,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5055,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134\u2026",
"port": 5055,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:5055 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:5055\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"target_port_label": "5055 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5055"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:5055"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
16/07/2026 07:34:15 UTC
TCP
5055
—
Sonde port
Sonde port · port 5055 · (sonde / probe)
Faible
Moyen · 44
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5055
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": null,
"app_proto": null,
"asn": 49870,
"country": "SC",
"dst_port": 5055,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 0.3,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "036c486b228a55339dbdc036dae738e9efcf0c32",
"event_fingerprint": "1969f032041f3fe79650c56c5213ac7dbf4b27ef",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 5055,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "115ccd45847573db95e21864dd2c751a7bdc9d46",
"protocol_details": {
"port": 5055
},
"attack_vector": "Sonde port \u00b7 port 5055 \u00b7 (sonde \/ probe)",
"target_port_label": "5055",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 5055,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"port": 5055
},
"attack_vector": "Sonde port \u00b7 port 5055 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "5055",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "5055"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
16/07/2026 07:16:48 UTC
TCP
8180 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:8180 · (tentative d'exploit) · → /api/route
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/route UA Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, l…
Émulateur
HTTP
WAF
62
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/api/route
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8180
Chemin / cible
/api/route
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 10 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /api/route HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.135 Mobile Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
k8s-api
Payload (extrait)
POST /api/route HTTP/1.1
Host: 62.3.50.33:8180
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (Linux; Android
Requête brute (extrait)
POST /api/route HTTP/1.1 Host: 62.3.50.33:8180 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.135 Mobile Safari/537.36 Accept-Encoding: gzip, deflate Next-
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "8563f2ed0fd1b3832e8c528ca96b1f98a5b0004e",
"http_host_hash": "dc3cb89e6ee2f9953198db0d09b0446c9efecbaa",
"http_target_hash": "1a9b2c3dbe8a713bfc0c240bb1a6ea2141b55601",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 949,
"payload_entropy": 5.647731738173042,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 8180,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 7.3,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 15,
"anomaly_count": 0,
"campaign_key": "1f168adcdb280ddba98119bf2d8cee38cec674f4",
"event_fingerprint": "2b3069e7f118b9638ba0e939dfed039477142fde",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "fcf5bfa409c42db4e4a5f32bcc91f966",
"payload_hash": "4b2167691509aa8cc57f92541a5cc68b",
"path_pattern_hash": "7c4fe35e07eebe8bea27a36c14378e32"
},
"target_context": {
"dst_port": 8180,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8180\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android",
"method": "POST",
"path": "\/api\/route",
"user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api\/route HTTP\/1.1",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8180\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8180\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android",
"evidence": {
"method": "POST",
"path": "\/api\/route",
"user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api\/route HTTP\/1.1",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8180\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8180\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a2124bd041e46f097118de71b9272cf286983a51",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/route",
"request_line": "POST \/api\/route HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
"port": 8180,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8180\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8180 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
"target_port_label": "8180 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8180,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/route",
"request_line": "POST \/api\/route HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
"port": 8180,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8180 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8180\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android",
"target_port_label": "8180 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 10 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8180"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:8180"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api",
"http_api_route_probe",
"http_contenttype_attack_surface",
"http_probe_api",
"http_prototype_pollution",
"http_ssti"
]
}
16/07/2026 07:16:47 UTC
TCP
8180 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:8180 · (tentative d'exploit) · → /_next/server
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /_next/server UA Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWeb…
Émulateur
HTTP
WAF
58
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/_next/server
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8180
Chemin / cible
/_next/server
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /_next/server HTTP/1.1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/134.0.6998.99 Mobile/15E148 Safari/604.1
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /_next/server HTTP/1.1
Host: 62.3.50.33:8180
Content-Length: 522
Connection: close
User-Agent: Mozilla/5.0 (iPhone; CPU
Requête brute (extrait)
POST /_next/server HTTP/1.1 Host: 62.3.50.33:8180 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/134.0.6998.99 Mobile/15E148 Safari/604.1 Accept-E
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "affd667937319ba36aa098ac5e3b53f4e282c1fe",
"http_host_hash": "dc3cb89e6ee2f9953198db0d09b0446c9efecbaa",
"http_target_hash": "bef481449499f499a0b29ed75c9630076205b04f",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 984,
"payload_entropy": 5.68586150394335,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 8180,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 7.3,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "90080ebe88bdb9a0456577605d70a4060b9ae4eb",
"event_fingerprint": "c7ca901c58614179d8d064d84761a449a6aa5518",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "6990db627a3d5a6ae3f8a2c22924225b",
"payload_hash": "d5699731dac4a7649414bfb4a6edf054",
"path_pattern_hash": "4d9c4ca8a8065d3ce7073b6b23f61056"
},
"target_context": {
"dst_port": 8180,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8180\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU",
"method": "POST",
"path": "\/_next\/server",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next\/server HTTP\/1.1",
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8180\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1\r\nAccept-E",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8180\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU",
"evidence": {
"method": "POST",
"path": "\/_next\/server",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next\/server HTTP\/1.1",
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8180\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1\r\nAccept-E",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8180\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0aceee238bf41c697caf12cba5be02ca0fcb61d3",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next\/server",
"request_line": "POST \/_next\/server HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mob\u2026",
"port": 8180,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8180\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8180 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
"target_port_label": "8180 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8180,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next\/server",
"request_line": "POST \/_next\/server HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mob\u2026",
"port": 8180,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8180 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8180\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU",
"target_port_label": "8180 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8180"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:8180"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
16/07/2026 07:16:47 UTC
TCP
8180 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:8180 · (tentative d'exploit) · → /app
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /app UA Mozilla/5.0 (Linux; Android 14; SM-F9560 Build/UP1A.231005.007;…
Émulateur
HTTP
WAF
52
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/app
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8180
Chemin / cible
/app
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /app HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 14; SM-F9560 Build/UP1A.231005.007; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/127.0.6533.103 Mobile Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /app HTTP/1.1
Host: 62.3.50.33:8180
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (Linux; Android 14; S
Requête brute (extrait)
POST /app HTTP/1.1 Host: 62.3.50.33:8180 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 14; SM-F9560 Build/UP1A.231005.007; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/127.0.6533.103 Mobile Safari/537.36
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "1978af5307537775fab4b66b0f1439319be37ce1",
"http_host_hash": "dc3cb89e6ee2f9953198db0d09b0446c9efecbaa",
"http_target_hash": "0c35eebf403cf91fe77a64921d76aa1ca6411d20",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 988,
"payload_entropy": 5.684096922130578,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 8180,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 7.3,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 11,
"anomaly_count": 0,
"campaign_key": "827b5ca1c9489e537e31112723245aeb134cb11f",
"event_fingerprint": "2a9e037346c36faf1db34c7584f0446603b3af19",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "7967be4fa492cfad4b86b41e3ae090e9",
"payload_hash": "0eb09841e7d6bad52cda05954169782f",
"path_pattern_hash": "f53b52ad6d21cceb72dfa78fb67614fe"
},
"target_context": {
"dst_port": 8180,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8180\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; S",
"method": "POST",
"path": "\/app",
"user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/app HTTP\/1.1",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8180\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.36",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8180\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; S",
"evidence": {
"method": "POST",
"path": "\/app",
"user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/app HTTP\/1.1",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8180\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.36",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8180\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; S",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "073cc4ee0c2ec7c42b822d073ea37e5f581cd28e",
"protocol_details": {
"http_method": "POST",
"http_path": "\/app",
"request_line": "POST \/app HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 \u2026",
"port": 8180,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8180\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; S",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8180 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
"target_port_label": "8180 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8180,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/app",
"request_line": "POST \/app HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 \u2026",
"port": 8180,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8180 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8180\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; S",
"target_port_label": "8180 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8180"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:8180"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
16/07/2026 07:16:46 UTC
TCP
8180 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:8180 · (tentative d'exploit) · → /api
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api UA Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KH…
Émulateur
HTTP
WAF
56
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/api
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8180
Chemin / cible
/api
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /api HTTP/1.1
User-Agent
Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
k8s-api
Payload (extrait)
POST /api HTTP/1.1
Host: 62.3.50.33:8180
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (X11; CrOS x86_64 145
Requête brute (extrait)
POST /api HTTP/1.1 Host: 62.3.50.33:8180 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: x X
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "d336075c3988c6b7205cebd57d13f49ace6a0b3b",
"http_host_hash": "dc3cb89e6ee2f9953198db0d09b0446c9efecbaa",
"http_target_hash": "ada91241341ae792ecf0a59cad28616a77bab856",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 937,
"payload_entropy": 5.64724537817406,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 8180,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 7.3,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 13,
"anomaly_count": 0,
"campaign_key": "4936c77618e2e8232bd0b6c75aa129c7a71e86cd",
"event_fingerprint": "622baafaaa1bf23681c0906ef1e2e7ed89322d5a",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "5ea6889a59d080298a42c0e1b4758211",
"payload_hash": "f0d762c603f566eff822237d11c3b5d3",
"path_pattern_hash": "702acf7c08d3b03b321d97b4903ad221"
},
"target_context": {
"dst_port": 8180,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8180\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145",
"method": "POST",
"path": "\/api",
"user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api HTTP\/1.1",
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8180\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8180\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145",
"evidence": {
"method": "POST",
"path": "\/api",
"user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api HTTP\/1.1",
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8180\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8180\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e9555d528b2b6959119d3c32be90d257e73d6781",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api",
"request_line": "POST \/api HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 8180,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8180\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8180 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
"target_port_label": "8180 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8180,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api",
"request_line": "POST \/api HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 8180,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8180 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8180\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145",
"target_port_label": "8180 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8180"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:8180"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api",
"http_contenttype_attack_surface",
"http_probe_api",
"http_prototype_pollution",
"http_ssti"
]
}
16/07/2026 07:16:45 UTC
TCP
8180 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:8180 · (tentative d'exploit) · → /_next
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /_next UA Mozilla/5.0 (Linux; Android 9; AFTWMST22 Build/PS7233; wv) Appl…
Émulateur
HTTP
WAF
52
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/_next
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8180
Chemin / cible
/_next
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /_next HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 9; AFTWMST22 Build/PS7233; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/88.0.4324.152 Mobile Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /_next HTTP/1.1
Host: 62.3.50.33:8180
Content-Length: 522
Connection: close
User-Agent: Mozilla/5.0 (Linux; Android 9;
Requête brute (extrait)
POST /_next HTTP/1.1 Host: 62.3.50.33:8180 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 9; AFTWMST22 Build/PS7233; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/88.0.4324.152 Mobile Safari/537.36 Accept
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "1cafc1ec7983977ff1b9c77c60e09ef5fe869a95",
"http_host_hash": "dc3cb89e6ee2f9953198db0d09b0446c9efecbaa",
"http_target_hash": "afd9bdeafd8c657f6b493ada03c51e348516227b",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 986,
"payload_entropy": 5.672273383291641,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 8180,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 7.3,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 11,
"anomaly_count": 0,
"campaign_key": "827b5ca1c9489e537e31112723245aeb134cb11f",
"event_fingerprint": "f3766ca2804ec495bb38b098c1fd20f78d8cb2d7",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c772734c6eb2978096c283068906aec3",
"payload_hash": "14e4cf9e2e3cd960237180571a5fe3bd",
"path_pattern_hash": "bfd33612e3863357684bd23d10455a76"
},
"target_context": {
"dst_port": 8180,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8180\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; ",
"method": "POST",
"path": "\/_next",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next HTTP\/1.1",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8180\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36\r\nAccept",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8180\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9;",
"evidence": {
"method": "POST",
"path": "\/_next",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next HTTP\/1.1",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8180\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36\r\nAccept",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8180\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9;",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "31fae46fa5ecb90cdeedf308efbd3ff698e22752",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next",
"request_line": "POST \/_next HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88\u2026",
"port": 8180,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8180\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9;",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8180 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
"target_port_label": "8180 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8180,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next",
"request_line": "POST \/_next HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88\u2026",
"port": 8180,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8180 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8180\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9;",
"target_port_label": "8180 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8180"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:8180"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
16/07/2026 07:16:44 UTC
TCP
8180 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:8180 · (tentative d'exploit)
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST / UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like…
Émulateur
HTTP
WAF
55
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8180
Chemin / cible
/
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST / HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
sap-sapcontrol-path
Payload (extrait)
POST / HTTP/1.1
Host: 62.3.50.33:8180
Content-Length: 517
Connection: close
User-Agent: Mozilla/5.0 (X11; Linux x86_64) Appl
Requête brute (extrait)
POST / HTTP/1.1 Host: 62.3.50.33:8180 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: x X-Nextjs-Requ
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "1c1f86ba252c0c8ebc250acab48718f12d6d1efd",
"http_host_hash": "dc3cb89e6ee2f9953198db0d09b0446c9efecbaa",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 924,
"payload_entropy": 5.648914946913591,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 8180,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 7.3,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "f12ddee82d1c12040f752c1863f8d5ad1a716e26",
"event_fingerprint": "b7fab66433be8e98b5ea9f01a11b7a580006fac9",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "72d43eb808798db218d063798749cc39",
"payload_hash": "2359d0c219e2222e35503ad4660b1e66",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8180,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8180\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Appl",
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8180\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-Requ",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8180\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Appl",
"evidence": {
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8180\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-Requ",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8180\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Appl",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a405e3121ee3834a6bdb6b9c9324b5fc1b0efd30",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 8180,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8180\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Appl",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8180 \u00b7 (tentative d'exploit)",
"target_port_label": "8180 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8180,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 8180,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8180 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8180\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Appl",
"target_port_label": "8180 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8180"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:8180"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
16/07/2026 07:16:43 UTC
TCP
8180
—
Sonde port
Sonde port · port 8180 · (sonde / probe)
Faible
Moyen · 44
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8180
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": null,
"app_proto": null,
"asn": 49870,
"country": "SC",
"dst_port": 8180,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "35c940c68fd41455b362b866484352f6c0fe6cbe",
"event_fingerprint": "e6a658dae6b08dc8dc83e529a6291bacd00de4b2",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 8180,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b328d0b11af54ea3f460e235332145990315c475",
"protocol_details": {
"port": 8180
},
"attack_vector": "Sonde port \u00b7 port 8180 \u00b7 (sonde \/ probe)",
"target_port_label": "8180",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 8180,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"port": 8180
},
"attack_vector": "Sonde port \u00b7 port 8180 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "8180",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "8180"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
16/07/2026 06:34:42 UTC
TCP
4000 · REMOTEANYTHING
Sonde HTTP smuggling
http smuggling probe · via REMOTEANYTHING:4000 · (tentative d'exploit)
Élevée
Moyen · 52
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
REMOTEANYTHING
WAF
—
Recommandation
Investiguer
Tags
mozi_pattern
net_mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
4000
Chemin / cible
—
Service
REMOTEANYTHING
Payload
POST /api/route HTTP/1.1 Host: 62.3.50.33:4000 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 52
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
User-Agent
—
Règles WAF
—
Payload (extrait)
POST /api/route HTTP/1.1
Host: 62.3.50.33:4000
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (Windows NT 10.
Requête brute (extrait)
POST /api/route HTTP/1.1 Host: 62.3.50.33:4000 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Actio
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742072656d6f7465616e797468696e6720726561647920706f72743d343030300d0a",
"emulator_response_len": 45,
"bytes_in": 944,
"payload_entropy": 5.6428959636235785,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "remoteanything",
"app_proto": "remoteanything",
"asn": 49870,
"country": "SC",
"dst_port": 4000,
"risk_waf": 8,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 0.9,
"risk_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 52,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "bd7dc59d6dfc70c84987d010d755c6d447462f81",
"event_fingerprint": "4e887c2a24c9c3c22b8104c54eb3d72176bb9c5c",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 52
},
"named_classification_skipped": false,
"service_name": "remoteanything",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "0d1855c21a190e4aa7c6825b975659bc",
"path_pattern_hash": "06b55a159b5d265fc8976ebb0a005f8a"
},
"target_context": {
"dst_port": 4000,
"service": "remoteanything",
"service_name": "remoteanything",
"risk_score": 52
},
"payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:4000\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:4000\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Actio",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:4000\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"evidence": {
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:4000\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Actio",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:4000\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8280b4e842b1e9739914e7a2ce9b0160d2392681",
"protocol_details": {
"payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:4000\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"port": 4000,
"service": "remoteanything",
"service_label_fr": "REMOTEANYTHING"
},
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:4000\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"attack_vector": "http smuggling probe \u00b7 via REMOTEANYTHING:4000 \u00b7 (tentative d'exploit)",
"target_port_label": "4000 \u00b7 REMOTEANYTHING",
"emulator_service": "remoteanything",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via REMOTEANYTHING",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 52
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "remoteanything",
"service_label_fr": "REMOTEANYTHING",
"dst_port": 4000,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-remoteanything",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:4000\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"port": 4000,
"service": "remoteanything",
"service_label_fr": "REMOTEANYTHING"
},
"attack_vector": "http smuggling probe \u00b7 via REMOTEANYTHING:4000 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:4000\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"target_port_label": "4000 \u00b7 REMOTEANYTHING",
"emulator_service": "remoteanything",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "remoteanything",
"service_banner": "honeypot-remoteanything",
"service_os": "linux",
"dst_port": "4000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"mozi_pattern",
"net_mozi_pattern"
]
}