Fiche IP

Singapour

161.118.254.100

Activité suspecte · risque 40/100

FAI Oracle Corporation Première vue 12/10/2026 12:48 UTC Dernière vue 12/10/2026 12:49 UTC Risque Moyen

Période 2026-07-15 → 2026-10-13

Moyen 51/100

24h 7j 30j 90j

Synthèse

Score de risque max. 51/100 Moyen · Maximum de risk_score (événements honeypot)

Première observation 12/10/2026 12:48 UTC

Dernière observation 12/10/2026 12:49 UTC

Événements (période) 7

MITRE ATT&CK principal TA0007 4 occurrences

Pourquoi listée

Type « web_probe » (signaux protocolaires) · confiance 68%

Confiance 68 % — Score WAF 8

Décision

Investiguer

Risque moyen. Relisez le port dominant et les preuves avant toute règle réseau.

51/100 Confiance 68 % 7 événements TA0007

À faire

Lire les preuves de la chronologie avant d’écrire une règle.
Comparer avec les IP du même FAI.
Annoter le verdict vrai positif ou faux positif.

Preuves JSON SOC

Note de ticket

IP 161.118.254.100
Décision : Investiguer
Score max : 51/100 (Moyen)
Confiance : 68 %
Période : 2026-07-15 → 2026-10-13 · 7 événements
Motif : Type « web_probe » (signaux protocolaires) · confiance 68%
MITRE : TA0007
FAI : Oracle Corporation · Singapour

Comparaison ASN / FAI

ASN 31898 · 161.118.192.0/18 · APNIC — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 7 événements sur la période pour cette IP.

129.146.171.191 Sonde proxy ouvert 13/10/2026 12:56 UTC
66.116.252.157 Sonde SSH 13/10/2026 00:45 UTC
161.118.202.204 Sonde fichier configuration 12/10/2026 12:53 UTC
161.118.234.54 Sonde Docker TLS 12/10/2026 12:50 UTC
161.118.240.138 Sonde HTTP alternatif (8000/TCP) 12/10/2026 12:50 UTC
140.245.112.8 Sonde Docker TLS 12/10/2026 12:49 UTC
161.118.232.74 Sonde HTTP 12/10/2026 12:49 UTC
168.107.91.104 Sonde Kubernetes API 12/10/2026 12:49 UTC

Événements (filtres)

Première observation

12/10/2026 12:48 UTC

Dernière observation

12/10/2026 12:49 UTC

Dernière activité (filtres)

12/10/2026 12:49 UTC

Événements 7j

Ports distincts (7j)

Classifications (7j)

Sévérité max (7j)

Élevée

Géolocalisation

Origine réseau déclarée

Singapour unknown unknown

FAI / réseau

Opérateur et dernière activité ban

Oracle Corporation 0 Port 11434 Sonde HTTP

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Sonde / probe

Chaîne d'attaque

Découverte

Vecteur d'attaque

Sonde HTTP · via HTTP:11434 · (sonde / probe) · → /.netrc

Détails protocole

Méthode: GET
Chemin: /.netrc
User-Agent: WebSiphon/next-0.1

Aperçu payload

GET /.netrc HTTP/1.1 accept: */* user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:11434

Port / service

11434 · HTTP

Service émulé

HTTP

Raison confiance

Confiance 68 % — Score WAF 8

Technique MITRE

TA0007

Persona capteur

mail.sensor-1.internal

Recommandation

Surveiller

Rôle capteur

Renseignement menaces

Confiance

68%

Famille de menace

scanner IP signalée (IPsum, 3 listes ou plus) IP malveillante (CINS Army)

MITRE ATT&CK — tactiques

Reconnaissance Développement Accès Exécution Persistance Élévation Contournement Accès Découverte Mouvement Collecte Commande Exfiltration Impact

Décomposition confiance

Décomposition du score

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Profil d’activité

Heures UTC et jours de la semaine, calculés sur les séries de la page

Heures UTC

Jours de semaine

Constats

Lecture automatique du volume, des ports et des créneaux UTC

Timeline

7 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

Part du volume sur la période filtrée

Top classifications

Libellés capteur, part du volume

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

7 événement(s) — page 1/1

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
12/10/2026 12:49:28 UTC	TCP	11434 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:11434 · (sonde / probe) · → /.netrc	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole GET /.netrc UA WebSiphon/next-0.1 Émulateur HTTP WAF 0 Recommandation Surveiller Tags net_web_probe Cible HTTP GET /.netrc TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 11434 Chemin / cible /.netrc Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 68% Confiance classification 68% Risque capteur Moyen · 40 Confiance : Confiance 68 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `GET /.netrc HTTP/1.1` User-Agent WebSiphon/next-0.1 Règles WAF — Payload (extrait) GET /.netrc HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:11434 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "netrc", "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524", "http_host_hash": "0edcf6ab7022a3c1a90b1ad0670bd95a56782eca", "http_target_hash": "b7551dc22135c68ecee0a4d011ec4c0b7c771e06", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 127, "payload_entropy": 5.05421207739348, "port_category": "registered", "org": "Oracle Corporation", "service": "http", "app_proto": "http", "asn": 31898, "country": "SG", "dst_port": 11434, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.5, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15 }, "risk_score": 40, "tag_count": 1, "anomaly_count": 0, "campaign_key": "5ef17226f4f731cb1cfc4323463c16ba228d7308", "event_fingerprint": "92635afcccdf8d6be8fa1601f183e1fe91081b51", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 31898, "org": "Oracle Corporation", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141", "payload_hash": "4a6e18a1708e2d8f7d6f53c473ab0934", "path_pattern_hash": "5fa317981ba713f7d39164540951d6bb" }, "service_name": "http", "target_context": { "dst_port": 11434, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "GET \/.netrc HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:11434\r\n\r\n", "method": "GET", "path": "\/.netrc", "user_agent": "WebSiphon\/next-0.1", "request_line": "GET \/.netrc HTTP\/1.1", "request_sample": "GET \/.netrc HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:11434\r\n\r\n", "payload_snippet": "GET \/.netrc HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:11434", "evidence": { "method": "GET", "path": "\/.netrc", "user_agent": "WebSiphon\/next-0.1", "request_line": "GET \/.netrc HTTP\/1.1", "request_sample": "GET \/.netrc HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:11434\r\n\r\n", "payload_snippet": "GET \/.netrc HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:11434", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 68%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 68%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.68, "classification_confidence": 0.68, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "43d9d2beecbf52a7c20a776f8500107198da8359", "protocol_details": { "http_method": "GET", "http_path": "\/.netrc", "request_line": "GET \/.netrc HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 11434, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/.netrc HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:11434", "attack_vector": "Sonde HTTP \u00b7 via HTTP:11434 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/.netrc", "target_port_label": "11434 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 68 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 68%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 68%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 68, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 11434, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/.netrc", "request_line": "GET \/.netrc HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 11434, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:11434 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/.netrc", "evidence_snippet": "GET \/.netrc HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:11434", "target_port_label": "11434 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 68 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 68 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "11434" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_web_probe" ] }
12/10/2026 12:49:28 UTC	TCP	11434 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:11434 · (sonde / probe) · → /.yarnrc.yml	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole GET /.yarnrc.yml UA WebSiphon/next-0.1 Émulateur HTTP WAF 0 Recommandation Surveiller Tags net_web_probe Cible HTTP GET /.yarnrc.yml TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 11434 Chemin / cible /.yarnrc.yml Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 68% Confiance classification 68% Risque capteur Moyen · 40 Confiance : Confiance 68 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `GET /.yarnrc.yml HTTP/1.1` User-Agent WebSiphon/next-0.1 Règles WAF — Payload (extrait) GET /.yarnrc.yml HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:11434 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "yml", "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524", "http_host_hash": "0edcf6ab7022a3c1a90b1ad0670bd95a56782eca", "http_target_hash": "2ee9db2ce90495b1c28f7b480828c842a0c0741b", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 132, "payload_entropy": 5.136493979756382, "port_category": "registered", "org": "Oracle Corporation", "service": "http", "app_proto": "http", "asn": 31898, "country": "SG", "dst_port": 11434, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.5, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15 }, "risk_score": 40, "tag_count": 1, "anomaly_count": 0, "campaign_key": "5ef17226f4f731cb1cfc4323463c16ba228d7308", "event_fingerprint": "d76993fc05cc7ecdde0ea17e938ccfef5d491448", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 31898, "org": "Oracle Corporation", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141", "payload_hash": "c9180f0cc28cff2ab84ffea4f554adf0", "path_pattern_hash": "7a712e1a2026fac036de3870db06701e" }, "service_name": "http", "target_context": { "dst_port": 11434, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "GET \/.yarnrc.yml HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:11434", "method": "GET", "path": "\/.yarnrc.yml", "user_agent": "WebSiphon\/next-0.1", "request_line": "GET \/.yarnrc.yml HTTP\/1.1", "request_sample": "GET \/.yarnrc.yml HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:11434\r\n\r\n", "payload_snippet": "GET \/.yarnrc.yml HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:11434", "evidence": { "method": "GET", "path": "\/.yarnrc.yml", "user_agent": "WebSiphon\/next-0.1", "request_line": "GET \/.yarnrc.yml HTTP\/1.1", "request_sample": "GET \/.yarnrc.yml HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:11434\r\n\r\n", "payload_snippet": "GET \/.yarnrc.yml HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:11434", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 68%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 68%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.68, "classification_confidence": 0.68, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b378dc82f518e816d10cd6e2ebc778ab6379be8c", "protocol_details": { "http_method": "GET", "http_path": "\/.yarnrc.yml", "request_line": "GET \/.yarnrc.yml HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 11434, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/.yarnrc.yml HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:11434", "attack_vector": "Sonde HTTP \u00b7 via HTTP:11434 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/.yarnrc.yml", "target_port_label": "11434 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 68 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 68%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 68%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 68, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 11434, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/.yarnrc.yml", "request_line": "GET \/.yarnrc.yml HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 11434, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:11434 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/.yarnrc.yml", "evidence_snippet": "GET \/.yarnrc.yml HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:11434", "target_port_label": "11434 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 68 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 68 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "11434" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_web_probe" ] }
12/10/2026 12:49:28 UTC	TCP	11434 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:11434 · (sonde / probe) · → /.oci/oci_api_key.pem	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole GET /.oci/oci_api_key.pem UA WebSiphon/next-0.1 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950468:nosqli-3 net_web_probe Cible HTTP GET /.oci/oci_api_key.pem TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 11434 Chemin / cible /.oci/oci_api_key.pem Service HTTP Pourquoi cette classification : Sonde HTTP (tag nosqli-3) · confiance 71% Confiance classification 71% Risque capteur Moyen · 40 Confiance : Confiance 71 % — Score WAF 32 · 1 tag(s) WAF Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `GET /.oci/oci_api_key.pem HTTP/1.1` User-Agent WebSiphon/next-0.1 Règles WAF nosqli-3 Payload (extrait) GET /.oci/oci_api_key.pem HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50 Requête brute (extrait) GET /.oci/oci_api_key.pem HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:11434 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": "pem", "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524", "http_host_hash": "0edcf6ab7022a3c1a90b1ad0670bd95a56782eca", "http_target_hash": "bd90365fba8b2c1a540e51db620bc101ffd3702c", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 141, "payload_entropy": 5.137155096420851, "port_category": "registered", "org": "Oracle Corporation", "service": "http", "app_proto": "http", "asn": 31898, "country": "SG", "dst_port": 11434, "risk_waf": 32, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.9, "risk_breakdown": { "waf": 32, "classification": 38, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15 }, "risk_score": 40, "tag_count": 2, "anomaly_count": 0, "campaign_key": "e9c8894a900c64c0c962d89cadc118befb5a5d94", "event_fingerprint": "2148bf83f7b42309b45bc2ef026610db7d0255b4", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 31898, "org": "Oracle Corporation", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141", "payload_hash": "d49f766ce1ae4ce84fed1f627b39eed2", "path_pattern_hash": "a6070e18607d9cfd8f9e3c73c2099446" }, "service_name": "http", "target_context": { "dst_port": 11434, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "GET \/.oci\/oci_api_key.pem HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50", "method": "GET", "path": "\/.oci\/oci_api_key.pem", "user_agent": "WebSiphon\/next-0.1", "waf_tags": [ "950468:nosqli-3" ], "waf_rule_names": [ "nosqli-3" ], "request_line": "GET \/.oci\/oci_api_key.pem HTTP\/1.1", "request_sample": "GET \/.oci\/oci_api_key.pem HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:11434\r\n\r\n", "payload_snippet": "GET \/.oci\/oci_api_key.pem HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50", "evidence": { "method": "GET", "path": "\/.oci\/oci_api_key.pem", "user_agent": "WebSiphon\/next-0.1", "waf_tags": [ "950468:nosqli-3" ], "waf_rule_names": [ "nosqli-3" ], "request_line": "GET \/.oci\/oci_api_key.pem HTTP\/1.1", "request_sample": "GET \/.oci\/oci_api_key.pem HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:11434\r\n\r\n", "payload_snippet": "GET \/.oci\/oci_api_key.pem HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50", "classification_reason": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 71%" }, "classification_reason": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 71%", "confidence_breakdown": { "waf": 32, "classification": 38, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.71, "classification_confidence": 0.71, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e47c4e46c59d39ae281b525f28f7f8618c26de25", "protocol_details": { "http_method": "GET", "http_path": "\/.oci\/oci_api_key.pem", "request_line": "GET \/.oci\/oci_api_key.pem HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 11434, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/.oci\/oci_api_key.pem HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50", "attack_vector": "Sonde HTTP \u00b7 via HTTP:11434 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/.oci\/oci_api_key.pem", "target_port_label": "11434 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 71 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 71%", "classification_reason_label_fr": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 71%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 71, "confidence_breakdown": { "waf": 32, "classification": 38, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 11434, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/.oci\/oci_api_key.pem", "request_line": "GET \/.oci\/oci_api_key.pem HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 11434, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:11434 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/.oci\/oci_api_key.pem", "evidence_snippet": "GET \/.oci\/oci_api_key.pem HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50", "target_port_label": "11434 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 71 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF", "confidence_factors_fr": "Confiance 71 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "11434" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950468:nosqli-3", "net_web_probe" ] }
12/10/2026 12:48:47 UTC	TCP	11434 · HTTP	http	Sonde fichier credential / clé credential file probe · via HTTP:11434 · (tentative d'exploit) · → /config/secrets.json	Élevée	Moyen · 51
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole GET /config/secrets.json UA WebSiphon/next-0.1 Émulateur HTTP WAF 6 Recommandation Investiguer Tags 950468:nosqli-3 http_k8s_probe http_probe_config net_web_probe Cible HTTP GET /config/secrets.json TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 11434 Chemin / cible /config/secrets.json Service HTTP Pourquoi cette classification : Sonde fichier sensible: fichier credential/clé · Règle WAF « nosqli-3 » · confiance 97% Confiance classification 97% Risque capteur Moyen · 51 Confiance : Confiance 97 % — Motif catalogue confirmé · 1 tag(s) WAF Protocole émulé 1 Signaux pat-0496 Upstream Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Secrets JSON file Ligne de requête `GET /config/secrets.json HTTP/1.1` User-Agent WebSiphon/next-0.1 Règles WAF nosqli-3 Payload (extrait) GET /config/secrets.json HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50. Requête brute (extrait) GET /config/secrets.json HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:11434 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": "json", "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524", "http_host_hash": "0edcf6ab7022a3c1a90b1ad0670bd95a56782eca", "http_target_hash": "d245df2b930ac6e64a12821e6902cce878e9a7ce", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 140, "payload_entropy": 5.076710402200668, "port_category": "registered", "org": "Oracle Corporation", "service": "http", "app_proto": "http", "asn": 31898, "country": "SG", "dst_port": 11434, "risk_waf": 32, "risk_classification": 82, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.6, "risk_breakdown": { "waf": 32, "classification": 82, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 51, "tag_count": 4, "anomaly_count": 0, "campaign_key": "0d2958831bfbf29edb473ed269b8345dff7e3d20", "event_fingerprint": "966ff4b9544cb733cf7891fa9ee9fdcc9d1eedbc", "classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 confiance 97%", "confidence": 0.97, "classification_confidence": 0.97, "precision_score": 105, "precision_signals": [ "pat-0496", "INT-upstream" ], "kb_rule_ids": [ "pat-0496", "INT-upstream" ], "matched_patterns": [ "pat-0496" ], "matched_pattern_names": [ "Cred Secrets JSON file" ], "pattern_ids": [ "pat-0496" ], "confidence_breakdown": { "waf": 32, "classification": 82, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 51 }, "named_classification_skipped": false, "classification_parent": "lfi_attack", "service_name": "http", "risk_confidence_factor": 97, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 31898, "org": "Oracle Corporation", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141", "payload_hash": "5ad187d675ac9ff83fb28dd8ef8309ff", "path_pattern_hash": "b82ce86956be379e0d4ab3fedf084ba0" }, "target_context": { "dst_port": 11434, "service": "http", "service_name": "http", "risk_score": 51 }, "payload_preview": "GET \/config\/secrets.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.", "method": "GET", "path": "\/config\/secrets.json", "user_agent": "WebSiphon\/next-0.1", "waf_tags": [ "950468:nosqli-3" ], "waf_rule_names": [ "nosqli-3" ], "request_line": "GET \/config\/secrets.json HTTP\/1.1", "request_sample": "GET \/config\/secrets.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:11434\r\n\r\n", "payload_snippet": "GET \/config\/secrets.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.", "evidence": { "method": "GET", "path": "\/config\/secrets.json", "user_agent": "WebSiphon\/next-0.1", "waf_tags": [ "950468:nosqli-3" ], "waf_rule_names": [ "nosqli-3" ], "request_line": "GET \/config\/secrets.json HTTP\/1.1", "request_sample": "GET \/config\/secrets.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:11434\r\n\r\n", "payload_snippet": "GET \/config\/secrets.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.", "classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 confiance 97%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "48c797350626c402292eab4f1efa327a3b271d61", "protocol_details": { "http_method": "GET", "http_path": "\/config\/secrets.json", "request_line": "GET \/config\/secrets.json HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 11434, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/config\/secrets.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.", "attack_vector": "credential file probe \u00b7 via HTTP:11434 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/secrets.json", "target_port_label": "11434 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 97 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 confiance 97%", "classification_reason_label_fr": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 confiance 97%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 97 % \u2014 via HTTP", "confidence_pct": 97, "confidence_breakdown": { "waf": 32, "classification": 82, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 51 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 51, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 11434, "protocol_emulated": true, "tags_summary": [ "pat-0496", "INT-upstream" ], "tags_summary_labels_fr": [ "pat-0496", "Upstream" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/config\/secrets.json", "request_line": "GET \/config\/secrets.json HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 11434, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "credential file probe \u00b7 via HTTP:11434 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/secrets.json", "evidence_snippet": "GET \/config\/secrets.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.", "target_port_label": "11434 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 97 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF", "confidence_factors_fr": "Confiance 97 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "11434" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950468:nosqli-3", "http_k8s_probe", "http_probe_config", "net_web_probe" ] }
12/10/2026 12:48:47 UTC	TCP	11434 · HTTP	http	Sonde fichier credential / clé credential file probe · via HTTP:11434 · (tentative d'exploit) · → /credentials.json	Élevée	Moyen · 51
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole GET /credentials.json UA WebSiphon/next-0.1 Émulateur HTTP WAF 0 Recommandation Investiguer Tags net_web_probe Cible HTTP GET /credentials.json TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 11434 Chemin / cible /credentials.json Service HTTP Pourquoi cette classification : Sonde fichier sensible: fichier credential/clé · Correspondance tags WAF · confiance 97% Confiance classification 97% Risque capteur Moyen · 51 Confiance : Confiance 97 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0472 Upstream Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Credentials JSON Ligne de requête `GET /credentials.json HTTP/1.1` User-Agent WebSiphon/next-0.1 Règles WAF — Payload (extrait) GET /credentials.json HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33: Requête brute (extrait) GET /credentials.json HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:11434 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "json", "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524", "http_host_hash": "0edcf6ab7022a3c1a90b1ad0670bd95a56782eca", "http_target_hash": "52ce12cd9608e2aaf265869963eb9ccc97689fda", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 137, "payload_entropy": 5.087017844496442, "port_category": "registered", "org": "Oracle Corporation", "service": "http", "app_proto": "http", "asn": 31898, "country": "SG", "dst_port": 11434, "risk_waf": 8, "risk_classification": 82, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.5, "risk_breakdown": { "waf": 8, "classification": 82, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15 }, "risk_score": 51, "tag_count": 1, "anomaly_count": 0, "campaign_key": "33d9098307121e311f4572e008f59116e70caba9", "event_fingerprint": "372102e4a01eed11467b81e720f2fd70f945ba77", "classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 Correspondance tags WAF \u00b7 confiance 97%", "confidence": 0.97, "classification_confidence": 0.97, "precision_score": 105, "precision_signals": [ "pat-0472", "INT-upstream" ], "kb_rule_ids": [ "pat-0472", "INT-upstream" ], "matched_patterns": [ "pat-0472" ], "matched_pattern_names": [ "Cred Credentials JSON" ], "pattern_ids": [ "pat-0472" ], "confidence_breakdown": { "waf": 8, "classification": 82, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 51 }, "named_classification_skipped": false, "classification_parent": "lfi_attack", "service_name": "http", "risk_confidence_factor": 97, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 31898, "org": "Oracle Corporation", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141", "payload_hash": "e9897fe8af79274b8446fe487ded360a", "path_pattern_hash": "2c897236c88b33a0e02927235471c8c3" }, "target_context": { "dst_port": 11434, "service": "http", "service_name": "http", "risk_score": 51 }, "payload_preview": "GET \/credentials.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:", "method": "GET", "path": "\/credentials.json", "user_agent": "WebSiphon\/next-0.1", "request_line": "GET \/credentials.json HTTP\/1.1", "request_sample": "GET \/credentials.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:11434\r\n\r\n", "payload_snippet": "GET \/credentials.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:", "evidence": { "method": "GET", "path": "\/credentials.json", "user_agent": "WebSiphon\/next-0.1", "request_line": "GET \/credentials.json HTTP\/1.1", "request_sample": "GET \/credentials.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:11434\r\n\r\n", "payload_snippet": "GET \/credentials.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:", "classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 Correspondance tags WAF \u00b7 confiance 97%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "fa12eaa8b7eddd4c873efc7127682a809b8d4506", "protocol_details": { "http_method": "GET", "http_path": "\/credentials.json", "request_line": "GET \/credentials.json HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 11434, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/credentials.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:", "attack_vector": "credential file probe \u00b7 via HTTP:11434 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/credentials.json", "target_port_label": "11434 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 97 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 Correspondance tags WAF \u00b7 confiance 97%", "classification_reason_label_fr": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 Correspondance tags WAF \u00b7 confiance 97%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 97 % \u2014 via HTTP", "confidence_pct": 97, "confidence_breakdown": { "waf": 8, "classification": 82, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 51 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 51, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 11434, "protocol_emulated": true, "tags_summary": [ "pat-0472", "INT-upstream" ], "tags_summary_labels_fr": [ "pat-0472", "Upstream" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/credentials.json", "request_line": "GET \/credentials.json HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 11434, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "credential file probe \u00b7 via HTTP:11434 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/credentials.json", "evidence_snippet": "GET \/credentials.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:", "target_port_label": "11434 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 97 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 97 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "11434" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "net_web_probe" ] }
12/10/2026 12:48:47 UTC	TCP	11434 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:11434 · (sonde / probe) · → /config.toml	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole GET /config.toml UA WebSiphon/next-0.1 Émulateur HTTP WAF 0 Recommandation Surveiller Tags net_web_probe Cible HTTP GET /config.toml TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 11434 Chemin / cible /config.toml Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 68% Confiance classification 68% Risque capteur Moyen · 40 Confiance : Confiance 68 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `GET /config.toml HTTP/1.1` User-Agent WebSiphon/next-0.1 Règles WAF — Payload (extrait) GET /config.toml HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:11434 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "toml", "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524", "http_host_hash": "0edcf6ab7022a3c1a90b1ad0670bd95a56782eca", "http_target_hash": "9143df5dbda21bd8fe091512028bb95a28535a1e", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 132, "payload_entropy": 5.108195968441915, "port_category": "registered", "org": "Oracle Corporation", "service": "http", "app_proto": "http", "asn": 31898, "country": "SG", "dst_port": 11434, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.5, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15 }, "risk_score": 40, "tag_count": 1, "anomaly_count": 0, "campaign_key": "5ef17226f4f731cb1cfc4323463c16ba228d7308", "event_fingerprint": "feaa3a23c3effb7fbcd52845832a19574e0f634b", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 31898, "org": "Oracle Corporation", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141", "payload_hash": "9965c97b01acd634bd97dd43c7a85151", "path_pattern_hash": "5932557804ccd992bd00d388ff9976b6" }, "service_name": "http", "target_context": { "dst_port": 11434, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "GET \/config.toml HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:11434", "method": "GET", "path": "\/config.toml", "user_agent": "WebSiphon\/next-0.1", "request_line": "GET \/config.toml HTTP\/1.1", "request_sample": "GET \/config.toml HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:11434\r\n\r\n", "payload_snippet": "GET \/config.toml HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:11434", "evidence": { "method": "GET", "path": "\/config.toml", "user_agent": "WebSiphon\/next-0.1", "request_line": "GET \/config.toml HTTP\/1.1", "request_sample": "GET \/config.toml HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:11434\r\n\r\n", "payload_snippet": "GET \/config.toml HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:11434", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 68%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 68%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.68, "classification_confidence": 0.68, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "467c06046ae5f2273599c9eb9800f75e71803d2d", "protocol_details": { "http_method": "GET", "http_path": "\/config.toml", "request_line": "GET \/config.toml HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 11434, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/config.toml HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:11434", "attack_vector": "Sonde HTTP \u00b7 via HTTP:11434 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/config.toml", "target_port_label": "11434 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 68 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 68%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 68%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 68, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 11434, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/config.toml", "request_line": "GET \/config.toml HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 11434, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:11434 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/config.toml", "evidence_snippet": "GET \/config.toml HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:11434", "target_port_label": "11434 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 68 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 68 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "11434" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_web_probe" ] }
12/10/2026 12:48:26 UTC	TCP	11434 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:11434 · (sonde / probe) · → /manifest.json	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1595 TA0007 TA0001 Protocole GET /manifest.json UA WebSiphon/next-0.1 Émulateur HTTP WAF 0 Recommandation Surveiller Tags net_web_probe Cible HTTP GET /manifest.json TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 11434 Chemin / cible /manifest.json Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 100% Confiance classification 100% Risque capteur Moyen · 45 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux Manifeste PWA / web app Single Port Chemin bénin connu Tag WAF SQLi (manifeste) Technique MITRE T1595 Tactiques MITRE TA0007 TA0001 Ligne de requête `GET /manifest.json HTTP/1.1` User-Agent WebSiphon/next-0.1 Règles WAF — Payload (extrait) GET /manifest.json HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:114 Requête brute (extrait) GET /manifest.json HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:11434 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6d616e69666573742b6a736f6e0d0a436f6e74656e742d4c656e6774683a203133360d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a7b226e616d65", "emulator_response_len": 258, "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "json", "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524", "http_host_hash": "0edcf6ab7022a3c1a90b1ad0670bd95a56782eca", "http_target_hash": "76da65f7f0a6a2a160ff7fc66ea8fe51b152d47a", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 134, "payload_entropy": 5.116353561508329, "port_category": "registered", "org": "Oracle Corporation", "service": "http", "app_proto": "http", "asn": 31898, "country": "SG", "dst_port": 11434, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.5, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15 }, "risk_score": 45, "tag_count": 1, "anomaly_count": 0, "campaign_key": "5ef17226f4f731cb1cfc4323463c16ba228d7308", "event_fingerprint": "13a8a224083e80517e066456530db78f1499d393", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 118, "precision_signals": [ "INT-benign-manifest", "INT-single-port", "INT-benign-path-cap", "INT-sqli-tag-only-manifest" ], "kb_rule_ids": [ "INT-benign-manifest", "INT-single-port", "INT-benign-path-cap", "INT-sqli-tag-only-manifest" ], "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 45 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 31898, "org": "Oracle Corporation", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141", "payload_hash": "3f0b21f8bd721f4ee924085483de381b", "path_pattern_hash": "d5ead976ced23841402a62764875fd71" }, "target_context": { "dst_port": 11434, "service": "http", "service_name": "http", "risk_score": 45 }, "payload_preview": "GET \/manifest.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:114", "method": "GET", "path": "\/manifest.json", "user_agent": "WebSiphon\/next-0.1", "request_line": "GET \/manifest.json HTTP\/1.1", "request_sample": "GET \/manifest.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:11434\r\n\r\n", "payload_snippet": "GET \/manifest.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:114", "evidence": { "method": "GET", "path": "\/manifest.json", "user_agent": "WebSiphon\/next-0.1", "request_line": "GET \/manifest.json HTTP\/1.1", "request_sample": "GET \/manifest.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:11434\r\n\r\n", "payload_snippet": "GET \/manifest.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:114", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1595" ], "mitre": "T1595", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4ee5fd1f27d85e2d4e2adcb7cceefff3d0b692c5", "protocol_details": { "http_method": "GET", "http_path": "\/manifest.json", "request_line": "GET \/manifest.json HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 11434, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/manifest.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:114", "attack_vector": "Sonde HTTP \u00b7 via HTTP:11434 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/manifest.json", "target_port_label": "11434 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 45 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 11434, "protocol_emulated": true, "tags_summary": [ "INT-benign-manifest", "INT-single-port", "INT-benign-path-cap", "INT-sqli-tag-only-manifest" ], "tags_summary_labels_fr": [ "Manifeste PWA \/ web app", "Single Port", "Chemin b\u00e9nin connu", "Tag WAF SQLi (manifeste)" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1595", "mitre_technique": "T1595", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/manifest.json", "request_line": "GET \/manifest.json HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 11434, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:11434 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/manifest.json", "evidence_snippet": "GET \/manifest.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:114", "target_port_label": "11434 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "11434" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_web_probe" ] }

Réputation

Sécurité avancée

Offensive / Recon

Sécurité

DNS

Réseau

E-mail

IP

Utilitaires

161.118.254.100

Synthèse

Pourquoi listée

Investiguer

À faire

Note de ticket

Comparaison ASN / FAI

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Décomposition du score

Filtres

Profil d’activité

Heures UTC

Jours de semaine

Constats

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

161.118.254.100

Pourquoi listée

Investiguer

À faire

Note de ticket

Comparaison ASN / FAI

IPs apparentées

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Décomposition du score

Filtres

Profil d’activité

Heures UTC

Jours de semaine

Constats

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence