Renseignement sur les menaces

États-Unis

162.217.100.41

FAI Internap Holding LLC Première vue 11/07/2026 00:36 UTC Dernière vue 20/07/2026 18:41 UTC Risque Moyen

Période analysée : 2026-04-21 → 2026-07-20

Activité suspecte · risque 35/100

Base IP Signaler JSON CSV Pro STIX 2.1 · JSON SOC ou contact

Réputation DNSBL WHOIS Ports

24h 7j 30j 90j

Moyen · Risque max (7j) Moyen

Synthèse exécutive

Profil de menace

Score de risque 59/100 Moyen

Première observation 11/07/2026 00:36 UTC

Dernière observation 20/07/2026 18:41 UTC

Événements (période) 314

MITRE ATT&CK principal TA0001 149 occurrences

Activité suspecte · risque 35/100

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

Type « postgres_probe » (signaux protocolaires) · confiance 49%

Confiance 57 % — Score WAF 8 · Bonus corrélation +8

Comparaison ASN / FAI

ASN 32475 · 162.217.96.0/21 · ARIN — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 314 événements sur la période pour cette IP.

162.217.100.36 SSRF 20/07/2026 19:01 UTC
203.55.131.4 Tentative d'exploit 20/07/2026 18:58 UTC
203.55.131.5 Tentative d'exploit 20/07/2026 18:41 UTC
162.217.100.196 Botnet Mozi 20/07/2026 18:16 UTC
162.217.100.201 SSRF 20/07/2026 17:02 UTC
203.55.131.3 Sonde port 143/TCP 20/07/2026 16:40 UTC
108.178.17.26 sip probe 19/07/2026 17:57 UTC
108.178.22.242 Protocole TDS MSSQL 14/07/2026 02:53 UTC

Événements (filtres)

314

Première observation

11/07/2026 00:36 UTC

Dernière observation

20/07/2026 18:41 UTC

Dernière activité (filtres)

20/07/2026 18:41 UTC

Événements 7j

218

Ports distincts (7j)

Classifications (7j)

Sévérité max (7j)

Élevée

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

HTTP TCP 149 TLS TCP 105 HTTPS TCP 12 SAP ICM TCP 12 KERBEROS TCP 5 CHARGEN TCP 3 POSTGRES TCP 3 DAYTIME TCP 3 QOTD TCP 3 SAP Diag TCP 3 ECHO TCP 3 NETBUS TCP 3 FTP DATA TCP 3 PERSONAL AGENT TCP 3 DISCARD TCP 2 MONGODB TCP 2

HTTP

149

TLS

105

HTTPS

SAP ICM

KERBEROS

CHARGEN

Géolocalisation

Origine réseau déclarée

États-Unis unknown unknown

FAI / réseau

Opérateur et dernière activité ban

Internap Holding LLC 0 Port 5 ssrf_attack

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Sonde / probe

Chaîne d'attaque

Découverte

Vecteur d'attaque

postgres probe · via TLS:5 · (sonde / probe)

Détails protocole

Empreinte JA3: 725543c78edf669194c11dc7

Aperçu payload

��!��v2<�(c<��*z��8��'��3�� L��MP�%��i�ڹ��2�4�6��+�/�,�0̨̩� �� c �

Port / service

5 · TLS

Service émulé

TLS

Raison confiance

Confiance 49 % — Motif catalogue confirmé

Technique MITRE

TA0007

Persona capteur

mail.sensor-1.internal

Corrélations comportementales

Multi-protocole corrélé (5 min)

Recommandation

Surveiller

Rôle capteur

Renseignement menaces

Signaux de précision

pat-0369

Confiance

57% Corrélation +8

Famille de menace

scanner

MITRE ATT&CK — tactiques

Reconnaissance Développement Accès Exécution Persistance Élévation Contournement Accès Découverte Mouvement Collecte Commande Exfiltration Impact

Décomposition confiance

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Timeline

314 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

SSH 22, RDP 3389, HTTP alternatifs…

Top classifications

Web, SSH, SAP, scans…

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

314 événement(s) — page 4/7

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
16/07/2026 02:12:18 UTC	TCP	5555 · PERSONAL AGENT	personal-agent	Botnet Mozi mozi pattern · via PERSONAL AGENT:5555 · (commande & contrôle)	Élevée	Faible · 36
Étape Commande & contrôle Chaîne Commande & contrôle Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0011 TA0011 Protocole Émulateur PERSONAL-AGENT WAF — Recommandation Surveiller Tags http_get_probe mozi_pattern net_mozi_pattern Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5555 Chemin / cible — Service PERSONAL AGENT Payload GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info Pourquoi cette classification : Type « mozi_pattern » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 36 Confiance : Confiance 0 % — 3 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0011 Tactiques MITRE TA0011 Motifs de détection (base) LFI Double-dot bypass User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: / Connection: close Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f7420706572736f6e616c5f6167656e7420726561647920706f72743d353535350d0a", "emulator_response_len": 45, "bytes_in": 165, "payload_entropy": 5.222494310506847, "port_category": "registered", "org": "Internap Holding LLC", "service": "personal-agent", "app_proto": "personal-agent", "asn": 32475, "country": "US", "dst_port": 5555, "risk_waf": 8, "risk_classification": 82, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 15, "risk_boost": 20, "risk_granularity": 2, "risk_breakdown": { "waf": 8, "classification": 82, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 15 }, "risk_score": 36, "tag_count": 3, "anomaly_count": 0, "campaign_key": "ca86f7325a99633c0a407616c60b49d56f6a905c", "event_fingerprint": "fbc7cd65c63777f6c38709cfcc0b6e7651d2fdc4", "classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 8, "classification": 82, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 15, "risk_score": 36 }, "named_classification_skipped": false, "service_name": "personal-agent", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 32475, "org": "Internap Holding LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "25e1dbb9dc3e9dd092f07b00f8ffcace", "path_pattern_hash": "762d384fab941f6d0c2239f19994f30e" }, "target_context": { "dst_port": 5555, "service": "personal-agent", "service_name": "personal-agent", "risk_score": 36 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "evidence": { "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "c2", "mitre_tactics": [ "TA0011" ], "mitre": "TA0011", "threat_family": [ "botnet" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6b875945505ce0628ccda5c4030e837d05844591", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "port": 5555, "service": "personal-agent", "service_label_fr": "PERSONAL AGENT" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "attack_vector": "mozi pattern \u00b7 via PERSONAL AGENT:5555 \u00b7 (commande & contr\u00f4le)", "target_port_label": "5555 \u00b7 PERSONAL AGENT", "emulator_service": "personal-agent", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 36\/100 (Faible) \u2014 MITRE TA0011 \u2014 via PERSONAL AGENT", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 82, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 15, "risk_score": 36 }, "attack_stage": "c2", "attack_stage_label": "Commande & contr\u00f4le", "attack_chain_stage": "command_and_control", "attack_chain_stage_label_fr": "Commande & contr\u00f4le", "risk_score": 36, "risk_label": "Faible", "service_name": "personal-agent", "service_label_fr": "PERSONAL AGENT", "dst_port": 5555, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0011", "mitre_technique": "TA0011", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-personal-agent", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "port": 5555, "service": "personal-agent", "service_label_fr": "PERSONAL AGENT" }, "attack_vector": "mozi pattern \u00b7 via PERSONAL AGENT:5555 \u00b7 (commande & contr\u00f4le)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "target_port_label": "5555 \u00b7 PERSONAL AGENT", "emulator_service": "personal-agent", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": true, "kind": "stage" }, { "key": "command_and_control", "label_fr": "Commande & contr\u00f4le", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "personal_agent", "service_banner": "honeypot-personal-agent", "service_os": "linux", "dst_port": "5555" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "command_and_control", "ban_policy": "advisory_monitor", "tags_list": [ "http_get_probe", "mozi_pattern", "net_mozi_pattern" ] }
16/07/2026 01:37:38 UTC	TCP	83 · TLS	tls	Sonde PostgreSQL postgres probe · via TLS:83 · (sonde / probe)	Moyenne	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole JA3 725543c78edf6691 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 83 Chemin / cible — Service TLS Payload ��8�9��BV�oC��J�)�(!ܷ� /�e"_ॄI� g γ6:a��H.�qRV>�+�/�,�0̨̩� �� c � Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 57% Corrélation +8 Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��8�9��BV�oC��J�)�(!ܷ� /�e"_ॄI� g γ6:a��H.�qRV>�+�/�,�0̨̩� �� c� Requête brute (extrait) ��8�9��BV�oC��J�)�(!ܷ� /�e"_ॄI� g γ6:a��H.�qRV>�+�/�,�0̨̩� �� c � �� 2+ 3��`��1�l��[�J�`,=�� Meta JSON brut { "tls_ja3_hash": "725543c78edf669194c11dc7a039b56e", "tls_sni": null, "bytes_in": 1487, "payload_entropy": 7.73792727672645, "port_category": "well_known", "org": "Internap Holding LLC", "service": "tls", "app_proto": "tls", "asn": 32475, "country": "US", "dst_port": 83, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.1, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 2, "anomaly_count": 0, "campaign_key": "2d3dadbe3565d076bb6dc6b5abadacd957ca9090", "event_fingerprint": "fa8f74759937d1bcd88ecb4cb119b54f42e10678", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.57, "classification_confidence": 0.57, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 32475, "org": "Internap Holding LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "725543c78edf669194c11dc7a039b56e", "payload_hash": "7deefdb954d1b864af5deec5d25fd1f8", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5" }, "target_context": { "dst_port": 83, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u00038\ufffd9\u0005\ufffd\ufffd\ufffd\ufffd\u0014BV\ufffdoC\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffdJ\ufffd)\ufffd(!\u0737\ufffd \/\ufffde\u0001\"_\u0944I\ufffd\u001b g \u03b36:a\ufffd\ufffd\u0013\u0001\ufffdH.\ufffdqRV>\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u00038\ufffd9\u0005\ufffd\ufffd\ufffd\ufffd\u0014BV\ufffdoC\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffdJ\ufffd)\ufffd(!\u0737\ufffd \/\ufffde\u0001\"_\u0944I\ufffd\u001b g \u03b36:a\ufffd\ufffd\u0013\u0001\ufffdH.\ufffdqRV>\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\u0010\u0000\u000e\u0011\ufffd\u0011\ufffd\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd`\u0003\ufffd\ufffd\ufffd\ufffd1\ufffdl\ufffd\ufffd[\ufffdJ\ufffd`,=\ufffd\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u00038\ufffd9\u0005\ufffd\ufffd\ufffd\ufffd\u0014BV\ufffdoC\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffdJ\ufffd)\ufffd(!\u0737\ufffd \/\ufffde\u0001\"_\u0944I\ufffd\u001b g \u03b36:a\ufffd\ufffd\u0013\u0001\ufffdH.\ufffdqRV>\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3267c1090726519160f6187a51a8f047c2100eb1", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u00038\ufffd9\u0005\ufffd\ufffd\ufffd\ufffd\u0014BV\ufffdoC\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffdJ\ufffd)\ufffd(!\u0737\ufffd \/\ufffde\u0001\"_\u0944I\ufffd\u001b g \u03b36:a\ufffd\ufffd\u0013\u0001\ufffdH.\ufffdqRV>\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "725543c78edf669194c11dc7a039b56e", "port": 83, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd8\ufffd9\ufffd\ufffd\ufffd\ufffdBV\ufffdoC\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdJ\ufffd)\ufffd(!\u0737\ufffd \/\ufffde\"_\u0944I\ufffd g \u03b36:a\ufffd\ufffd\ufffdH.\ufffdqRV>\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd", "attack_vector": "postgres probe \u00b7 via TLS:83 \u00b7 (sonde \/ probe)", "target_port_label": "83 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 57, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 83, "protocol_emulated": null, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u00038\ufffd9\u0005\ufffd\ufffd\ufffd\ufffd\u0014BV\ufffdoC\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffdJ\ufffd)\ufffd(!\u0737\ufffd \/\ufffde\u0001\"_\u0944I\ufffd\u001b g \u03b36:a\ufffd\ufffd\u0013\u0001\ufffdH.\ufffdqRV>\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "725543c78edf669194c11dc7a039b56e", "port": 83, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "postgres probe \u00b7 via TLS:83 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd8\ufffd9\ufffd\ufffd\ufffd\ufffdBV\ufffdoC\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdJ\ufffd)\ufffd(!\u0737\ufffd \/\ufffde\"_\u0944I\ufffd g \u03b36:a\ufffd\ufffd\ufffdH.\ufffdqRV>\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd", "target_port_label": "83 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "83" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni" ] }
16/07/2026 01:37:37 UTC	TCP	83 · HTTP	http	SSRF ssrf attack · via HTTP:83 · (tentative d'exploit)	Élevée	Moyen · 57
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-lab… Émulateur HTTP WAF 22 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 83 Chemin / cible / Service HTTP Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 57 Confiance : Confiance 50 % — 4 tag(s) WAF Signaux Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Règles WAF rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: / Connection: close Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "2cce74947ae104861c6404693b60cc04c0330b1d", "http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 165, "payload_entropy": 5.222494310506847, "port_category": "well_known", "org": "Internap Holding LLC", "service": "http", "app_proto": "http", "asn": 32475, "country": "US", "dst_port": 83, "risk_waf": 96, "risk_classification": 84, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.8, "risk_breakdown": { "waf": 96, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 57, "tag_count": 4, "anomaly_count": 0, "campaign_key": "713880a9e87061957c2a165d7c8e15b433d94302", "event_fingerprint": "59997007a4b709d77b057e725a7b9a94d3749890", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "confidence": 0.5, "classification_confidence": 0.5, "precision_score": 55, "precision_signals": [ "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 96, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 57 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 32475, "org": "Internap Holding LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "83dce64baa2f0543cbc5015d0224fa45", "payload_hash": "25e1dbb9dc3e9dd092f07b00f8ffcace", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 83, "service": "http", "service_name": "http", "risk_score": 57 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f7c6b3175db17f0894b525e1072a871e74b56695", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "port": 83, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "attack_vector": "ssrf attack \u00b7 via HTTP:83 \u00b7 (tentative d'exploit)", "target_port_label": "83 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP", "confidence_pct": 50, "confidence_breakdown": { "waf": 96, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 57 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 57, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 83, "protocol_emulated": null, "tags_summary": [ "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "port": 83, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "ssrf attack \u00b7 via HTTP:83 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "target_port_label": "83 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "83" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ] }
16/07/2026 00:49:08 UTC	TCP	7636 · TLS	tls	Sonde PostgreSQL postgres probe · via TLS:7636 · (sonde / probe)	Moyenne	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole JA3 725543c78edf6691 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7636 Chemin / cible — Service TLS Payload ��>�r��J��?��c��ԇ ��y7� ��a��I�k�FYx��.�2�� 8OY�+�/�,�0̨̩� �� c � Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 57% Corrélation +8 Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��>�r��J��?��c��ԇ ��y7� ��a��I�k�FYx��.�2�� 8OY�+�/�,�0̨̩� �� c� Requête brute (extrait) ��>�r��J��?��c��ԇ ��y7� ��a��I�k�FYx��.�2�� 8OY�+�/�,�0̨̩� �� c � �� 2+ 3��{Z�x`�ڬ�1�eO� � Meta JSON brut { "tls_ja3_hash": "725543c78edf669194c11dc7a039b56e", "tls_sni": null, "bytes_in": 1487, "payload_entropy": 7.742370259417556, "port_category": "registered", "org": "Internap Holding LLC", "service": "tls", "app_proto": "tls", "asn": 32475, "country": "US", "dst_port": 7636, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.3, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 2, "anomaly_count": 0, "campaign_key": "f1bd4b596813c801b9eee38ba881cc84b9b3b6a2", "event_fingerprint": "03b72d3f4c5cebdb9e2fe33041c1459228647f42", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.57, "classification_confidence": 0.57, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 32475, "org": "Internap Holding LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "725543c78edf669194c11dc7a039b56e", "payload_hash": "17a51fee2e0130a7a8eb4d8ca5ad324e", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5" }, "target_context": { "dst_port": 7636, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd>\ufffdr\ufffd\ufffdJ\ufffd\ufffd?\ufffd\u001c\u0013\ufffdc\u000e\ufffd\ufffd\u0507\n\ufffd\ufffd\ufffd\ufffd\ufffdy7\ufffd\u0019 \ufffd\u0000\ufffd\ufffd\u0017\ufffda\ufffd\ufffd\ufffd\ufffdI\ufffd\u0005k\ufffdFYx\ufffd\ufffd.\ufffd2\ufffd\u0016\ufffd\r\ufffd8OY\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd>\ufffdr\ufffd\ufffdJ\ufffd\ufffd?\ufffd\u001c\u0013\ufffdc\u000e\ufffd\ufffd\u0507\n\ufffd\ufffd\ufffd\ufffd\ufffdy7\ufffd\u0019 \ufffd\u0000\ufffd\ufffd\u0017\ufffda\ufffd\ufffd\ufffd\ufffdI\ufffd\u0005k\ufffdFYx\ufffd\ufffd.\ufffd2\ufffd\u0016\ufffd\r\ufffd8OY\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\u0010\u0000\u000e\u0011\ufffd\u0011\ufffd\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd{Z\ufffdx`\u0004\u000e\ufffd\u06ac\ufffd1\ufffdeO\ufffd \ufffd", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd>\ufffdr\ufffd\ufffdJ\ufffd\ufffd?\ufffd\u001c\u0013\ufffdc\u000e\ufffd\ufffd\u0507\n\ufffd\ufffd\ufffd\ufffd\ufffdy7\ufffd\u0019 \ufffd\u0000\ufffd\ufffd\u0017\ufffda\ufffd\ufffd\ufffd\ufffdI\ufffd\u0005k\ufffdFYx\ufffd\ufffd.\ufffd2\ufffd\u0016\ufffd\r\ufffd8OY\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "74e89fd63876a4fe23eb41fc4f9362a97721cfd5", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd>\ufffdr\ufffd\ufffdJ\ufffd\ufffd?\ufffd\u001c\u0013\ufffdc\u000e\ufffd\ufffd\u0507\n\ufffd\ufffd\ufffd\ufffd\ufffdy7\ufffd\u0019 \ufffd\u0000\ufffd\ufffd\u0017\ufffda\ufffd\ufffd\ufffd\ufffdI\ufffd\u0005k\ufffdFYx\ufffd\ufffd.\ufffd2\ufffd\u0016\ufffd\r\ufffd8OY\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "725543c78edf669194c11dc7a039b56e", "port": 7636, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd>\ufffdr\ufffd\ufffdJ\ufffd\ufffd?\ufffd\ufffdc\ufffd\ufffd\u0507\n\ufffd\ufffd\ufffd\ufffd\ufffdy7\ufffd \ufffd\ufffd\ufffd\ufffda\ufffd\ufffd\ufffd\ufffdI\ufffdk\ufffdFYx\ufffd\ufffd.\ufffd2\ufffd\ufffd\r\ufffd8OY\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd", "attack_vector": "postgres probe \u00b7 via TLS:7636 \u00b7 (sonde \/ probe)", "target_port_label": "7636 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 57, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 7636, "protocol_emulated": null, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd>\ufffdr\ufffd\ufffdJ\ufffd\ufffd?\ufffd\u001c\u0013\ufffdc\u000e\ufffd\ufffd\u0507\n\ufffd\ufffd\ufffd\ufffd\ufffdy7\ufffd\u0019 \ufffd\u0000\ufffd\ufffd\u0017\ufffda\ufffd\ufffd\ufffd\ufffdI\ufffd\u0005k\ufffdFYx\ufffd\ufffd.\ufffd2\ufffd\u0016\ufffd\r\ufffd8OY\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "725543c78edf669194c11dc7a039b56e", "port": 7636, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "postgres probe \u00b7 via TLS:7636 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd>\ufffdr\ufffd\ufffdJ\ufffd\ufffd?\ufffd\ufffdc\ufffd\ufffd\u0507\n\ufffd\ufffd\ufffd\ufffd\ufffdy7\ufffd \ufffd\ufffd\ufffd\ufffda\ufffd\ufffd\ufffd\ufffdI\ufffdk\ufffdFYx\ufffd\ufffd.\ufffd2\ufffd\ufffd\r\ufffd8OY\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd", "target_port_label": "7636 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "7636" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni" ] }
16/07/2026 00:49:07 UTC	TCP	7636 · HTTP	http	SSRF ssrf attack · via HTTP:7636 · (tentative d'exploit)	Élevée	Moyen · 56
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-lab… Émulateur HTTP WAF 22 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7636 Chemin / cible / Service HTTP Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 56 Confiance : Confiance 50 % — 4 tag(s) WAF Signaux Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Règles WAF rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: / Connection: close Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "2cce74947ae104861c6404693b60cc04c0330b1d", "http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 165, "payload_entropy": 5.222494310506847, "port_category": "registered", "org": "Internap Holding LLC", "service": "http", "app_proto": "http", "asn": 32475, "country": "US", "dst_port": 7636, "risk_waf": 96, "risk_classification": 84, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3, "risk_breakdown": { "waf": 96, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 56, "tag_count": 4, "anomaly_count": 0, "campaign_key": "8b1db45a9bb17d663b60cdb3a94f69ec8b62c4c6", "event_fingerprint": "cd096ae9e0f7bdd4865616117c08a45a9c7754d3", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "confidence": 0.5, "classification_confidence": 0.5, "precision_score": 55, "precision_signals": [ "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 96, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 56 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 32475, "org": "Internap Holding LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "83dce64baa2f0543cbc5015d0224fa45", "payload_hash": "25e1dbb9dc3e9dd092f07b00f8ffcace", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 7636, "service": "http", "service_name": "http", "risk_score": 56 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "082445bf0eb08289700a2505b8e83ff8b7ff7eb2", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "port": 7636, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "attack_vector": "ssrf attack \u00b7 via HTTP:7636 \u00b7 (tentative d'exploit)", "target_port_label": "7636 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP", "confidence_pct": 50, "confidence_breakdown": { "waf": 96, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 56 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 56, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7636, "protocol_emulated": null, "tags_summary": [ "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "port": 7636, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "ssrf attack \u00b7 via HTTP:7636 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "target_port_label": "7636 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7636" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ] }
15/07/2026 23:26:57 UTC	TCP	5432 · POSTGRES	postgres	Sonde PostgreSQL postgresql probe · via POSTGRES:5432 · (sonde / probe)	Élevée	Faible · 34
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Handshake PostgreSQL (startup) Émulateur POSTGRES WAF — Recommandation Surveiller Tags http_get_probe mozi_pattern net_postgresql_probe postgres_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5432 Chemin / cible — Service POSTGRES Payload GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info Pourquoi cette classification : Type « postgresql_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 34 Confiance : Confiance 0 % — 4 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: / Connection: close Meta JSON brut { "protocol_emulated": true, "bytes_in": 165, "payload_entropy": 5.222494310506847, "port_category": "registered", "org": "Internap Holding LLC", "service": "postgres", "app_proto": "postgres", "asn": 32475, "country": "US", "dst_port": 5432, "risk_waf": 8, "risk_classification": 54, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 46, "risk_novelty": 15, "risk_boost": 20, "risk_granularity": 2.5, "risk_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 0, "protocol": 46, "novelty": 15 }, "risk_score": 34, "tag_count": 4, "anomaly_count": 0, "campaign_key": "7f7db99e5caf82bb59c1068ec217caeb7a57946a", "event_fingerprint": "4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f", "classification_reason": "Type \u00ab postgresql_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 0, "protocol": 46, "novelty": 15, "risk_score": 34 }, "named_classification_skipped": false, "service_name": "postgres", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 32475, "org": "Internap Holding LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "25e1dbb9dc3e9dd092f07b00f8ffcace", "path_pattern_hash": "2e6f775d89e58a7f725edffbb3ac7743" }, "target_context": { "dst_port": 5432, "service": "postgres", "service_name": "postgres", "risk_score": 34 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "evidence": { "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "classification_reason": "Type \u00ab postgresql_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5a35f62b308547be6410c560e005165183198a5a", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "attack_vector": "postgresql probe \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgresql_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab postgresql_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 0, "protocol": 46, "novelty": 15, "risk_score": 34 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 34, "risk_label": "Faible", "service_name": "postgres", "service_label_fr": "POSTGRES", "dst_port": 5432, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "PostgreSQL 15.4", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "attack_vector": "postgresql probe \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "postgres", "service_banner": "PostgreSQL 15.4", "service_os": "linux", "dst_port": "5432" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "http_get_probe", "mozi_pattern", "net_postgresql_probe", "postgres_emulated" ] }
15/07/2026 22:45:40 UTC	TCP	8008 · HTTP	http	SSRF ssrf attack · via HTTP:8008 · (tentative d'exploit)	Élevée	Moyen · 57
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-lab… Émulateur HTTP WAF 22 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8008 Chemin / cible / Service HTTP Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 57 Confiance : Confiance 50 % — 4 tag(s) WAF Protocole émulé 1 Signaux Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Règles WAF rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: / Connection: close Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "2cce74947ae104861c6404693b60cc04c0330b1d", "http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 165, "payload_entropy": 5.222494310506847, "port_category": "registered", "org": "Internap Holding LLC", "service": "http", "app_proto": "http", "asn": 32475, "country": "US", "dst_port": 8008, "risk_waf": 96, "risk_classification": 84, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 96, "classification": 84, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25 }, "risk_score": 57, "tag_count": 5, "anomaly_count": 0, "campaign_key": "0b5a411189e9809bc6963f077aef6253d3178d69", "event_fingerprint": "3f58ca66b82e590e58f688047fd9f0853aa32d5b", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "confidence": 0.5, "classification_confidence": 0.5, "precision_score": 55, "precision_signals": [ "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 96, "classification": 84, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 57 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 32475, "org": "Internap Holding LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "83dce64baa2f0543cbc5015d0224fa45", "payload_hash": "25e1dbb9dc3e9dd092f07b00f8ffcace", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 8008, "service": "http", "service_name": "http", "risk_score": 57 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f243695505149210d0885d113f3cd31918a57b58", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "port": 8008, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "attack_vector": "ssrf attack \u00b7 via HTTP:8008 \u00b7 (tentative d'exploit)", "target_port_label": "8008 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP", "confidence_pct": 50, "confidence_breakdown": { "waf": 96, "classification": 84, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 57 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 57, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8008, "protocol_emulated": true, "tags_summary": [ "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "port": 8008, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "ssrf attack \u00b7 via HTTP:8008 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "target_port_label": "8008 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8008" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path", "net_web_probe" ] }
15/07/2026 22:45:40 UTC	TCP	8008 · HTTP	http	SSRF ssrf attack · via HTTP:8008 · (tentative d'exploit) · → /favicon.ico	Élevée	Moyen · 52
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole GET /favicon.ico UA Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-lab… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 net_web_probe Cible HTTP GET /favicon.ico TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8008 Chemin / cible /favicon.ico Service HTTP Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 52 Confiance : Confiance 50 % — 3 tag(s) WAF Protocole émulé 1 Signaux Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET /favicon.ico HTTP/1.1` User-Agent Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/sc Requête brute (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: / Connection: close Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d547970653a20696d6167652f782d69636f6e0d0a436f6e74656e742d4c656e6774683a2032320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a0000010001001010000001002000680400001600", "emulator_response_len": 130, "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "ico", "http_ua_hash": "2cce74947ae104861c6404693b60cc04c0330b1d", "http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349", "http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 176, "payload_entropy": 5.2055424095882366, "port_category": "registered", "org": "Internap Holding LLC", "service": "http", "app_proto": "http", "asn": 32475, "country": "US", "dst_port": 8008, "risk_waf": 84, "risk_classification": 84, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3, "risk_breakdown": { "waf": 84, "classification": 84, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15 }, "risk_score": 52, "tag_count": 4, "anomaly_count": 0, "campaign_key": "46a3e466effc650db7a83e0364ece1385db7ed30", "event_fingerprint": "73f66f70b328f66e69718adcdd4c9badc8835a18", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "confidence": 0.5, "classification_confidence": 0.5, "precision_score": 55, "precision_signals": [ "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 84, "classification": 84, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 52 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 32475, "org": "Internap Holding LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "83dce64baa2f0543cbc5015d0224fa45", "payload_hash": "d56ec1d099a290ccb29eb2acc5ada1e0", "path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a" }, "target_context": { "dst_port": 8008, "service": "http", "service_name": "http", "risk_score": 52 }, "payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/sc", "method": "GET", "path": "\/favicon.ico", "user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/favicon.ico HTTP\/1.1", "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/sc", "evidence": { "method": "GET", "path": "\/favicon.ico", "user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/favicon.ico HTTP\/1.1", "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/sc", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3dcce1922f6c17fe53e7256370d0d56b4eca6561", "protocol_details": { "http_method": "GET", "http_path": "\/favicon.ico", "request_line": "GET \/favicon.ico HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "port": 8008, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/sc", "attack_vector": "ssrf attack \u00b7 via HTTP:8008 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/favicon.ico", "target_port_label": "8008 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP", "confidence_pct": 50, "confidence_breakdown": { "waf": 84, "classification": 84, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 52 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 52, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8008, "protocol_emulated": true, "tags_summary": [ "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "http_method": "GET", "http_path": "\/favicon.ico", "request_line": "GET \/favicon.ico HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "port": 8008, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "ssrf attack \u00b7 via HTTP:8008 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/favicon.ico", "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/sc", "target_port_label": "8008 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 84 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8008" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "net_web_probe" ] }
15/07/2026 20:46:06 UTC	TCP	9002 · HTTP	http	SSRF ssrf attack · via HTTP:9002 · (tentative d'exploit)	Élevée	Moyen · 57
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-lab… Émulateur HTTP WAF 22 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9002 Chemin / cible / Service HTTP Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 57 Confiance : Confiance 50 % — 4 tag(s) WAF Protocole émulé 1 Signaux Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Règles WAF rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: / Connection: close Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "2cce74947ae104861c6404693b60cc04c0330b1d", "http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 165, "payload_entropy": 5.222494310506847, "port_category": "registered", "org": "Internap Holding LLC", "service": "http", "app_proto": "http", "asn": 32475, "country": "US", "dst_port": 9002, "risk_waf": 96, "risk_classification": 84, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.7, "risk_breakdown": { "waf": 96, "classification": 84, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25 }, "risk_score": 57, "tag_count": 5, "anomaly_count": 0, "campaign_key": "299715c3adfbdbfc3e9b77293bf998c1a63cccaa", "event_fingerprint": "8fdd553994b7f3179072a978a6ea56799e9327ed", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "confidence": 0.5, "classification_confidence": 0.5, "precision_score": 55, "precision_signals": [ "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 96, "classification": 84, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 57 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 32475, "org": "Internap Holding LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "83dce64baa2f0543cbc5015d0224fa45", "payload_hash": "25e1dbb9dc3e9dd092f07b00f8ffcace", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 9002, "service": "http", "service_name": "http", "risk_score": 57 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a335deb0bc10756a5625fc62d823ced9bc7fb022", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "port": 9002, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "attack_vector": "ssrf attack \u00b7 via HTTP:9002 \u00b7 (tentative d'exploit)", "target_port_label": "9002 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP", "confidence_pct": 50, "confidence_breakdown": { "waf": 96, "classification": 84, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 57 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 57, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9002, "protocol_emulated": true, "tags_summary": [ "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "port": 9002, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "ssrf attack \u00b7 via HTTP:9002 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "target_port_label": "9002 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9002" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path", "net_web_probe" ] }
15/07/2026 20:46:06 UTC	TCP	9002 · HTTP	http	SSRF ssrf attack · via HTTP:9002 · (tentative d'exploit) · → /favicon.ico	Élevée	Moyen · 52
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole GET /favicon.ico UA Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-lab… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 net_web_probe Cible HTTP GET /favicon.ico TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9002 Chemin / cible /favicon.ico Service HTTP Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 52 Confiance : Confiance 50 % — 3 tag(s) WAF Protocole émulé 1 Signaux Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET /favicon.ico HTTP/1.1` User-Agent Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/sc Requête brute (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: / Connection: close Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d547970653a20696d6167652f782d69636f6e0d0a436f6e74656e742d4c656e6774683a2032320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a0000010001001010000001002000680400001600", "emulator_response_len": 130, "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "ico", "http_ua_hash": "2cce74947ae104861c6404693b60cc04c0330b1d", "http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349", "http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 176, "payload_entropy": 5.2055424095882366, "port_category": "registered", "org": "Internap Holding LLC", "service": "http", "app_proto": "http", "asn": 32475, "country": "US", "dst_port": 9002, "risk_waf": 84, "risk_classification": 84, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.3, "risk_breakdown": { "waf": 84, "classification": 84, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15 }, "risk_score": 52, "tag_count": 4, "anomaly_count": 0, "campaign_key": "e491d506f6472e93714ac0dd8194745b0457f627", "event_fingerprint": "40148073b59fcc9cd50c56278bdef17086f7d902", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "confidence": 0.5, "classification_confidence": 0.5, "precision_score": 55, "precision_signals": [ "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 84, "classification": 84, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 52 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 32475, "org": "Internap Holding LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "83dce64baa2f0543cbc5015d0224fa45", "payload_hash": "d56ec1d099a290ccb29eb2acc5ada1e0", "path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a" }, "target_context": { "dst_port": 9002, "service": "http", "service_name": "http", "risk_score": 52 }, "payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/sc", "method": "GET", "path": "\/favicon.ico", "user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/favicon.ico HTTP\/1.1", "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/sc", "evidence": { "method": "GET", "path": "\/favicon.ico", "user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/favicon.ico HTTP\/1.1", "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/sc", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "fbc16e2dfa0e855607e3dd07fe053f2f0d7ecd5e", "protocol_details": { "http_method": "GET", "http_path": "\/favicon.ico", "request_line": "GET \/favicon.ico HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "port": 9002, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/sc", "attack_vector": "ssrf attack \u00b7 via HTTP:9002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/favicon.ico", "target_port_label": "9002 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP", "confidence_pct": 50, "confidence_breakdown": { "waf": 84, "classification": 84, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 52 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 52, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9002, "protocol_emulated": true, "tags_summary": [ "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "http_method": "GET", "http_path": "\/favicon.ico", "request_line": "GET \/favicon.ico HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "port": 9002, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "ssrf attack \u00b7 via HTTP:9002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/favicon.ico", "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/sc", "target_port_label": "9002 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 84 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9002" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "net_web_probe" ] }
15/07/2026 19:54:23 UTC	TCP	82 · HTTP	http	SSRF ssrf attack · via HTTP:82 · (tentative d'exploit)	Élevée	Moyen · 57
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-lab… Émulateur HTTP WAF 22 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 82 Chemin / cible / Service HTTP Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 57 Confiance : Confiance 50 % — 4 tag(s) WAF Signaux Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Règles WAF rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: / Connection: close Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "2cce74947ae104861c6404693b60cc04c0330b1d", "http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 165, "payload_entropy": 5.222494310506847, "port_category": "well_known", "org": "Internap Holding LLC", "service": "http", "app_proto": "http", "asn": 32475, "country": "US", "dst_port": 82, "risk_waf": 96, "risk_classification": 84, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 96, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 57, "tag_count": 4, "anomaly_count": 0, "campaign_key": "3ba803ddbb344133449d42acb206789cb5b7a3ad", "event_fingerprint": "0aa58678cab6820462bd24bddf3946a2963e01ae", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "confidence": 0.5, "classification_confidence": 0.5, "precision_score": 55, "precision_signals": [ "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 96, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 57 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 32475, "org": "Internap Holding LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "83dce64baa2f0543cbc5015d0224fa45", "payload_hash": "25e1dbb9dc3e9dd092f07b00f8ffcace", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 82, "service": "http", "service_name": "http", "risk_score": 57 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "037d5b6cdf6c918ef9a59a7af75ce36b9a3a4ab6", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "port": 82, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "attack_vector": "ssrf attack \u00b7 via HTTP:82 \u00b7 (tentative d'exploit)", "target_port_label": "82 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP", "confidence_pct": 50, "confidence_breakdown": { "waf": 96, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 57 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 57, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 82, "protocol_emulated": null, "tags_summary": [ "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "port": 82, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "ssrf attack \u00b7 via HTTP:82 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "target_port_label": "82 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "82" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ] }
15/07/2026 19:54:23 UTC	TCP	82 · TLS	tls	Sonde PostgreSQL postgres probe · via TLS:82 · (sonde / probe)	Moyenne	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole JA3 725543c78edf6691 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 82 Chemin / cible — Service TLS Payload ��,�DۚBt�p�#�&��l��5 %lK�N8J��۩ykD��/�IN��"ض��+�/�,�0̨̩� �� c � Pourquoi cette classification :* Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 57% Corrélation +8 Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��,�DۚBt�p�#�&��l��5 %lK�N8J��۩ykD��/�IN��"ض��+�/�,�0̨̩� �� c� Requête brute (extrait) ��,�DۚBt�p�#�&��l��5 %lK�N8J��۩ykD��/�IN��"ض��+�/�,�0̨̩� �� c � �� 2+ 3��!S��f�;�`��r( Meta JSON brut { "tls_ja3_hash": "725543c78edf669194c11dc7a039b56e", "tls_sni": null, "bytes_in": 1487, "payload_entropy": 7.723385282683982, "port_category": "well_known", "org": "Internap Holding LLC", "service": "tls", "app_proto": "tls", "asn": 32475, "country": "US", "dst_port": 82, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.9, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 2, "anomaly_count": 0, "campaign_key": "284541edca3fe3cb1c24e6e8862ecf2c8f3f1935", "event_fingerprint": "1f7a2e43c839f7e36bf1528fa9a7a6d4416d9ad0", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.57, "classification_confidence": 0.57, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 32475, "org": "Internap Holding LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "725543c78edf669194c11dc7a039b56e", "payload_hash": "68a38273b45c711649f999524d01b8bb", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5" }, "target_context": { "dst_port": 82, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003,\u0005\u0000\ufffd\u001cD\u06daBt\u0001\ufffdp\ufffd#\ufffd&\ufffd\ufffd\ufffd\u0015\ufffdl\ufffd\u0015\ufffd\u001e\ufffd\u001b\ufffd5 %lK\ufffdN8J\ufffd\u001e\ufffd\u06e9yk\u000f\u0015\u0017D\ufffd\u001f\ufffd\/\ufffdIN\ufffd\ufffd\"\u001d\u0636\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003,\u0005\u0000\ufffd\u001cD\u06daBt\u0001\ufffdp\ufffd#\ufffd&\ufffd\ufffd\ufffd\u0015\ufffdl\ufffd\u0015\ufffd\u001e\ufffd\u001b\ufffd5 %lK\ufffdN8J\ufffd\u001e\ufffd\u06e9yk\u000f\u0015\u0017D\ufffd\u001f\ufffd\/\ufffdIN\ufffd\ufffd\"\u001d\u0636\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\u0010\u0000\u000e\u0011\ufffd\u0011\ufffd\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd!\u001eS\u0001\u000f\ufffd\ufffd\u0016\ufffdf\ufffd;\u0019\ufffd`\ufffd\ufffdr(", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003,\u0005\u0000\ufffd\u001cD\u06daBt\u0001\ufffdp\ufffd#\ufffd&\ufffd\ufffd\ufffd\u0015\ufffdl\ufffd\u0015\ufffd\u001e\ufffd\u001b\ufffd5 %lK\ufffdN8J\ufffd\u001e\ufffd\u06e9yk\u000f\u0015\u0017D\ufffd\u001f\ufffd\/\ufffdIN\ufffd\ufffd\"\u001d\u0636\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f0f8d000f22ea77749d82ad3599e2e4d44f815e3", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003,\u0005\u0000\ufffd\u001cD\u06daBt\u0001\ufffdp\ufffd#\ufffd&\ufffd\ufffd\ufffd\u0015\ufffdl\ufffd\u0015\ufffd\u001e\ufffd\u001b\ufffd5 %lK\ufffdN8J\ufffd\u001e\ufffd\u06e9yk\u000f\u0015\u0017D\ufffd\u001f\ufffd\/\ufffdIN\ufffd\ufffd\"\u001d\u0636\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "725543c78edf669194c11dc7a039b56e", "port": 82, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd,\ufffdD\u06daBt\ufffdp\ufffd#\ufffd&\ufffd\ufffd\ufffd\ufffdl\ufffd\ufffd\ufffd\ufffd5 %lK\ufffdN8J\ufffd\ufffd\u06e9ykD\ufffd\ufffd\/\ufffdIN\ufffd\ufffd\"\u0636\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd", "attack_vector": "postgres probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)", "target_port_label": "82 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 57, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 82, "protocol_emulated": null, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003,\u0005\u0000\ufffd\u001cD\u06daBt\u0001\ufffdp\ufffd#\ufffd&\ufffd\ufffd\ufffd\u0015\ufffdl\ufffd\u0015\ufffd\u001e\ufffd\u001b\ufffd5 %lK\ufffdN8J\ufffd\u001e\ufffd\u06e9yk\u000f\u0015\u0017D\ufffd\u001f\ufffd\/\ufffdIN\ufffd\ufffd\"\u001d\u0636\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "725543c78edf669194c11dc7a039b56e", "port": 82, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "postgres probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd,\ufffd*D\u06daBt\ufffdp\ufffd#\ufffd&\ufffd\ufffd\ufffd\ufffdl\ufffd\ufffd\ufffd\ufffd5 %lK\ufffdN8J\ufffd\ufffd\u06e9ykD\ufffd\ufffd\/\ufffdIN\ufffd\ufffd\"\u0636\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd", "target_port_label": "82 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "82" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni" ] }
15/07/2026 18:54:01 UTC	TCP	1234 · TLS	tls	Sonde PostgreSQL postgres probe · via TLS:1234 · (sonde / probe)	Moyenne	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole JA3 725543c78edf6691 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1234 Chemin / cible — Service TLS Payload ����s�B^��3��<��x{p�'2� ǘo��o2��[n��~7&��� +�/�,�0̨̩� �� c � Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 57% Corrélation +8 Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ����s�B^��3��<��x{p�'2� ǘo��o2��[n��~7&��� +�/�,�0̨̩� �� c� Requête brute (extrait) ����s�B^��3��<��x{p�'2� ǘo��o2��[n��~7&��� +�/�,�0̨̩� �� c � �� 2+ 3��O�V��u�yt`�3B3Y��� Meta JSON brut { "tls_ja3_hash": "725543c78edf669194c11dc7a039b56e", "tls_sni": null, "bytes_in": 1487, "payload_entropy": 7.746552823464366, "port_category": "registered", "org": "Internap Holding LLC", "service": "tls", "app_proto": "tls", "asn": 32475, "country": "US", "dst_port": 1234, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.7, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 2, "anomaly_count": 0, "campaign_key": "6332551f5bd79ec3119f5b9f286887dffc583d07", "event_fingerprint": "920f838b24b788ae9a34235d6d120ce8213479f4", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.57, "classification_confidence": 0.57, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 32475, "org": "Internap Holding LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "725543c78edf669194c11dc7a039b56e", "payload_hash": "5d8b8dfbdbdd42e268042d062e8b0172", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5" }, "target_context": { "dst_port": 1234, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0005\ufffd\ufffd\ufffds\ufffdB^\ufffd\ufffd\ufffd\ufffd\ufffd3\ufffd\ufffd<\ufffd\ufffdx{p\ufffd'2\u000f\ufffd \u01d8o\u0019\ufffd\u0000\ufffd\ufffd\ufffdo2\ufffd\ufffd[\u0010n\ufffd\ufffd\ufffd~7&\ufffd\u000e\u0007\ufffd\ufffd \u0019\ufffd\b\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0005\ufffd\ufffd\ufffds\ufffdB^\ufffd\ufffd\ufffd\ufffd\ufffd3\ufffd\ufffd<\ufffd\ufffdx{p\ufffd'2\u000f\ufffd \u01d8o\u0019\ufffd\u0000\ufffd\ufffd\ufffdo2\ufffd\ufffd[\u0010n\ufffd\ufffd\ufffd~7&\ufffd\u000e\u0007\ufffd\ufffd \u0019\ufffd\b\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\u0010\u0000\u000e\u0011\ufffd\u0011\ufffd\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffdO\ufffdV\ufffd\ufffdu\ufffdyt`\ufffd\u00143B3Y\ufffd\ufffd\ufffd\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0005\ufffd\ufffd\ufffds\ufffdB^\ufffd\ufffd\ufffd\ufffd\ufffd3\ufffd\ufffd<\ufffd\ufffdx{p\ufffd'2\u000f\ufffd \u01d8o\u0019\ufffd\u0000\ufffd\ufffd\ufffdo2\ufffd\ufffd[\u0010n\ufffd\ufffd\ufffd~7&\ufffd\u000e\u0007\ufffd\ufffd \u0019\ufffd\b\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "19d0f0ab644fe5f4b499c3d441001c38a67c503b", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0005\ufffd\ufffd\ufffds\ufffdB^\ufffd\ufffd\ufffd\ufffd\ufffd3\ufffd\ufffd<\ufffd\ufffdx{p\ufffd'2\u000f\ufffd \u01d8o\u0019\ufffd\u0000\ufffd\ufffd\ufffdo2\ufffd\ufffd[\u0010n\ufffd\ufffd\ufffd~7&\ufffd\u000e\u0007\ufffd\ufffd \u0019\ufffd\b\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "725543c78edf669194c11dc7a039b56e", "port": 1234, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffds\ufffdB^\ufffd\ufffd\ufffd\ufffd\ufffd3\ufffd\ufffd<\ufffd\ufffdx{p\ufffd'2\ufffd \u01d8o\ufffd\ufffd\ufffd\ufffdo2\ufffd\ufffd[n\ufffd\ufffd\ufffd~7&\ufffd\ufffd\ufffd \ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd", "attack_vector": "postgres probe \u00b7 via TLS:1234 \u00b7 (sonde \/ probe)", "target_port_label": "1234 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 57, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 1234, "protocol_emulated": null, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0005\ufffd\ufffd\ufffds\ufffdB^\ufffd\ufffd\ufffd\ufffd\ufffd3\ufffd\ufffd<\ufffd\ufffdx{p\ufffd'2\u000f\ufffd \u01d8o\u0019\ufffd\u0000\ufffd\ufffd\ufffdo2\ufffd\ufffd[\u0010n\ufffd\ufffd\ufffd~7&\ufffd\u000e\u0007\ufffd\ufffd \u0019\ufffd\b\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "725543c78edf669194c11dc7a039b56e", "port": 1234, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "postgres probe \u00b7 via TLS:1234 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffds\ufffdB^\ufffd\ufffd\ufffd\ufffd\ufffd3\ufffd\ufffd<\ufffd\ufffdx{p\ufffd'2\ufffd \u01d8o\ufffd\ufffd\ufffd\ufffdo2\ufffd\ufffd[n\ufffd\ufffd\ufffd~7&\ufffd\ufffd\ufffd \ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd", "target_port_label": "1234 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "1234" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni" ] }
15/07/2026 18:54:00 UTC	TCP	1234 · HTTP	http	SSRF ssrf attack · via HTTP:1234 · (tentative d'exploit)	Élevée	Moyen · 58
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-lab… Émulateur HTTP WAF 22 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 1234 Chemin / cible / Service HTTP Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 58 Confiance : Confiance 50 % — 4 tag(s) WAF Signaux Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Règles WAF rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: / Connection: close Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "2cce74947ae104861c6404693b60cc04c0330b1d", "http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 165, "payload_entropy": 5.222494310506847, "port_category": "registered", "org": "Internap Holding LLC", "service": "http", "app_proto": "http", "asn": 32475, "country": "US", "dst_port": 1234, "risk_waf": 96, "risk_classification": 84, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.4, "risk_breakdown": { "waf": 96, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 58, "tag_count": 4, "anomaly_count": 0, "campaign_key": "3c1f11e9377347cdbfeab3f2adcb57588d74222a", "event_fingerprint": "d657504e36867f383ad978de2291163a77a171a4", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "confidence": 0.5, "classification_confidence": 0.5, "precision_score": 55, "precision_signals": [ "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 96, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 58 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 32475, "org": "Internap Holding LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "83dce64baa2f0543cbc5015d0224fa45", "payload_hash": "25e1dbb9dc3e9dd092f07b00f8ffcace", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 1234, "service": "http", "service_name": "http", "risk_score": 58 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9f03b35d0c80a63cdf4022756b05a8bc3f082f8c", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "port": 1234, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "attack_vector": "ssrf attack \u00b7 via HTTP:1234 \u00b7 (tentative d'exploit)", "target_port_label": "1234 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP", "confidence_pct": 50, "confidence_breakdown": { "waf": 96, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 58 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 58, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 1234, "protocol_emulated": null, "tags_summary": [ "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "port": 1234, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "ssrf attack \u00b7 via HTTP:1234 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "target_port_label": "1234 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "1234" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ] }
15/07/2026 16:38:06 UTC	TCP	13 · DAYTIME	daytime	Botnet Mozi mozi pattern · via DAYTIME:13 · (commande & contrôle)	Élevée	Faible · 36
Étape Commande & contrôle Chaîne Commande & contrôle Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0011 TA0011 Protocole Émulateur DAYTIME WAF — Recommandation Surveiller Tags http_get_probe mozi_pattern net_mozi_pattern Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 13 Chemin / cible — Service DAYTIME Payload GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info Pourquoi cette classification : Type « mozi_pattern » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 36 Confiance : Confiance 0 % — 3 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0011 Tactiques MITRE TA0011 Motifs de détection (base) LFI Double-dot bypass User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: / Connection: close Meta JSON brut { "protocol_emulated": true, "emulator_response": "546875204a756e2020342031323a30303a303020323032360d0a", "emulator_response_len": 26, "bytes_in": 165, "payload_entropy": 5.222494310506847, "port_category": "well_known", "org": "Internap Holding LLC", "service": "daytime", "app_proto": "daytime", "asn": 32475, "country": "US", "dst_port": 13, "risk_waf": 8, "risk_classification": 82, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 15, "risk_boost": 20, "risk_granularity": 3.1, "risk_breakdown": { "waf": 8, "classification": 82, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 15 }, "risk_score": 36, "tag_count": 3, "anomaly_count": 0, "campaign_key": "8b81552b64eb438d8100a262cabb42682f3c99a5", "event_fingerprint": "5cb6f1d0b2a41cc9ad660eed6f01dbbd01638ddd", "classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 8, "classification": 82, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 15, "risk_score": 36 }, "named_classification_skipped": false, "service_name": "daytime", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 32475, "org": "Internap Holding LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "25e1dbb9dc3e9dd092f07b00f8ffcace", "path_pattern_hash": "762d384fab941f6d0c2239f19994f30e" }, "target_context": { "dst_port": 13, "service": "daytime", "service_name": "daytime", "risk_score": 36 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "evidence": { "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "c2", "mitre_tactics": [ "TA0011" ], "mitre": "TA0011", "threat_family": [ "botnet" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "87880c92ff48b6b6a53fab2a1ea0ed71de135a03", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "port": 13, "service": "daytime", "service_label_fr": "DAYTIME" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "attack_vector": "mozi pattern \u00b7 via DAYTIME:13 \u00b7 (commande & contr\u00f4le)", "target_port_label": "13 \u00b7 DAYTIME", "emulator_service": "daytime", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 36\/100 (Faible) \u2014 MITRE TA0011 \u2014 via DAYTIME", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 82, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 15, "risk_score": 36 }, "attack_stage": "c2", "attack_stage_label": "Commande & contr\u00f4le", "attack_chain_stage": "command_and_control", "attack_chain_stage_label_fr": "Commande & contr\u00f4le", "risk_score": 36, "risk_label": "Faible", "service_name": "daytime", "service_label_fr": "DAYTIME", "dst_port": 13, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0011", "mitre_technique": "TA0011", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-daytime", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "port": 13, "service": "daytime", "service_label_fr": "DAYTIME" }, "attack_vector": "mozi pattern \u00b7 via DAYTIME:13 \u00b7 (commande & contr\u00f4le)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "target_port_label": "13 \u00b7 DAYTIME", "emulator_service": "daytime", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": true, "kind": "stage" }, { "key": "command_and_control", "label_fr": "Commande & contr\u00f4le", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "daytime", "service_banner": "honeypot-daytime", "service_os": "linux", "dst_port": "13" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "command_and_control", "ban_policy": "advisory_monitor", "tags_list": [ "http_get_probe", "mozi_pattern", "net_mozi_pattern" ] }
15/07/2026 11:46:01 UTC	TCP	5432 · POSTGRES	postgres	Sonde PostgreSQL postgresql probe · via POSTGRES:5432 · (sonde / probe)	Élevée	Faible · 34
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Handshake PostgreSQL (startup) Émulateur POSTGRES WAF — Recommandation Surveiller Tags http_get_probe mozi_pattern net_postgresql_probe postgres_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5432 Chemin / cible — Service POSTGRES Payload GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info Pourquoi cette classification : Type « postgresql_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 34 Confiance : Confiance 0 % — 4 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: / Connection: close Meta JSON brut { "protocol_emulated": true, "bytes_in": 165, "payload_entropy": 5.222494310506847, "port_category": "registered", "org": "Internap Holding LLC", "service": "postgres", "app_proto": "postgres", "asn": 32475, "country": "US", "dst_port": 5432, "risk_waf": 8, "risk_classification": 54, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 46, "risk_novelty": 15, "risk_boost": 20, "risk_granularity": 2.5, "risk_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 0, "protocol": 46, "novelty": 15 }, "risk_score": 34, "tag_count": 4, "anomaly_count": 0, "campaign_key": "7f7db99e5caf82bb59c1068ec217caeb7a57946a", "event_fingerprint": "4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f", "classification_reason": "Type \u00ab postgresql_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 0, "protocol": 46, "novelty": 15, "risk_score": 34 }, "named_classification_skipped": false, "service_name": "postgres", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 32475, "org": "Internap Holding LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "25e1dbb9dc3e9dd092f07b00f8ffcace", "path_pattern_hash": "2e6f775d89e58a7f725edffbb3ac7743" }, "target_context": { "dst_port": 5432, "service": "postgres", "service_name": "postgres", "risk_score": 34 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "evidence": { "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "classification_reason": "Type \u00ab postgresql_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5a35f62b308547be6410c560e005165183198a5a", "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "attack_vector": "postgresql probe \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgresql_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab postgresql_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 0, "protocol": 46, "novelty": 15, "risk_score": 34 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 34, "risk_label": "Faible", "service_name": "postgres", "service_label_fr": "POSTGRES", "dst_port": 5432, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "PostgreSQL 15.4", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "postgres_startup_fr": "Handshake PostgreSQL (startup)", "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "port": 5432, "service": "postgres", "service_label_fr": "POSTGRES" }, "attack_vector": "postgresql probe \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "target_port_label": "5432 \u00b7 POSTGRES", "emulator_service": "postgres", "confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "postgres", "service_banner": "PostgreSQL 15.4", "service_os": "linux", "dst_port": "5432" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "http_get_probe", "mozi_pattern", "net_postgresql_probe", "postgres_emulated" ] }
15/07/2026 10:11:07 UTC	TCP	27017 · MONGODB	mongodb	Protocole wire MongoDB mongodb wire protocol · via MONGODB:27017 · (sonde / probe)	Élevée	Moyen · 43
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MONGODB WAF — Recommandation Surveiller Tags http_get_probe mongodb_emulated mongodb_wire_protocol mozi_pattern Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 27017 Chemin / cible — Service MONGODB Payload GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info Pourquoi cette classification : Type « mongodb_wire_protocol » (signaux protocolaires) · confiance 80% Confiance classification 80% Risque capteur Moyen · 43 Confiance : Confiance 80 % — 5 signal(aux) capteur Protocole émulé 1 Signaux ET-PROTO-MongoDB-Wire Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: / Connection: close Meta JSON brut { "protocol_emulated": true, "emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00", "emulator_response_len": 62, "bytes_in": 165, "payload_entropy": 5.222494310506847, "port_category": "registered", "org": "Internap Holding LLC", "service": "mongodb", "app_proto": "mongodb", "asn": 32475, "country": "US", "dst_port": 27017, "risk_waf": 8, "risk_classification": 58, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 46, "risk_novelty": 25, "risk_boost": 20, "risk_granularity": 4.3, "risk_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 0, "protocol": 46, "novelty": 25 }, "risk_score": 43, "tag_count": 5, "anomaly_count": 0, "campaign_key": "937ec695b377cda38207574b50416d0b01631fa9", "event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783", "classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 80%", "confidence": 0.8, "classification_confidence": 0.8, "precision_score": 90, "precision_signals": [ "ET-PROTO-MongoDB-Wire", "INT-upstream" ], "kb_rule_ids": [ "ET-PROTO-MongoDB-Wire", "INT-upstream" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 0, "protocol": 46, "novelty": 25, "risk_score": 43 }, "named_classification_skipped": false, "classification_parent": "mongodb_probe", "service_name": "mongodb", "risk_confidence_factor": 80, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 32475, "org": "Internap Holding LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "25e1dbb9dc3e9dd092f07b00f8ffcace", "path_pattern_hash": "9060bd55aeb34075959b54fecab264ea" }, "target_context": { "dst_port": 27017, "service": "mongodb", "service_name": "mongodb", "risk_score": 43 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "evidence": { "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 80%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e4700fb27b11a0ea7f27b8f0043c0326c36da950", "protocol_details": { "mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)", "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "port": 27017, "service": "mongodb", "service_label_fr": "MONGODB" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)", "target_port_label": "27017 \u00b7 MONGODB", "emulator_service": "mongodb", "confidence_reason": "Confiance 80 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 80%", "classification_reason_label_fr": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 80%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 43\/100", "confidence_pct": 80, "confidence_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 0, "protocol": 46, "novelty": 25, "risk_score": 43 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 43, "risk_label": "Moyen", "service_name": "mongodb", "service_label_fr": "MONGODB", "dst_port": 27017, "protocol_emulated": true, "tags_summary": [ "ET-PROTO-MongoDB-Wire", "INT-upstream" ], "tags_summary_labels_fr": [ "ET-PROTO-MongoDB-Wire", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mongodb", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)", "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "port": 27017, "service": "mongodb", "service_label_fr": "MONGODB" }, "attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "target_port_label": "27017 \u00b7 MONGODB", "emulator_service": "mongodb", "confidence_reason": "Confiance 80 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": "Confiance 80 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mongodb", "service_banner": "honeypot-mongodb", "service_os": "linux", "dst_port": "27017" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "http_get_probe", "mongodb_emulated", "mongodb_wire_protocol", "mozi_pattern", "net_mongodb_wire_protocol" ] }
15/07/2026 07:42:39 UTC	TCP	81 · HTTP	http	SSRF ssrf attack · via HTTP:81 · (tentative d'exploit)	Élevée	Moyen · 58
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-lab… Émulateur HTTP WAF 22 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 81 Chemin / cible / Service HTTP Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 58 Confiance : Confiance 50 % — 4 tag(s) WAF Protocole émulé 1 Signaux Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Règles WAF rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: / Connection: close Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "2cce74947ae104861c6404693b60cc04c0330b1d", "http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 165, "payload_entropy": 5.222494310506847, "port_category": "well_known", "org": "Internap Holding LLC", "service": "http", "app_proto": "http", "asn": 32475, "country": "US", "dst_port": 81, "risk_waf": 96, "risk_classification": 84, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 4.8, "risk_breakdown": { "waf": 96, "classification": 84, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25 }, "risk_score": 58, "tag_count": 5, "anomaly_count": 0, "campaign_key": "c0d4db67e02d617f50b8f675ce4051d1a72189b9", "event_fingerprint": "dc548988a809f1697c51218198b1d9a5eaa2cace", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "confidence": 0.5, "classification_confidence": 0.5, "precision_score": 55, "precision_signals": [ "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 96, "classification": 84, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 58 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 32475, "org": "Internap Holding LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "83dce64baa2f0543cbc5015d0224fa45", "payload_hash": "25e1dbb9dc3e9dd092f07b00f8ffcace", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 81, "service": "http", "service_name": "http", "risk_score": 58 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4ca76c14d19e044a805c55722165ef302bd63441", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "port": 81, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "attack_vector": "ssrf attack \u00b7 via HTTP:81 \u00b7 (tentative d'exploit)", "target_port_label": "81 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP", "confidence_pct": 50, "confidence_breakdown": { "waf": 96, "classification": 84, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 58 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 58, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 81, "protocol_emulated": true, "tags_summary": [ "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "port": 81, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "ssrf attack \u00b7 via HTTP:81 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "target_port_label": "81 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "81" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path", "net_web_probe" ] }
15/07/2026 07:42:39 UTC	TCP	81 · HTTP	http	SSRF ssrf attack · via HTTP:81 · (tentative d'exploit) · → /favicon.ico	Élevée	Moyen · 54
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole GET /favicon.ico UA Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-lab… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 net_web_probe Cible HTTP GET /favicon.ico TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 81 Chemin / cible /favicon.ico Service HTTP Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 54 Confiance : Confiance 50 % — 3 tag(s) WAF Protocole émulé 1 Signaux Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET /favicon.ico HTTP/1.1` User-Agent Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/sc Requête brute (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: / Connection: close Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d547970653a20696d6167652f782d69636f6e0d0a436f6e74656e742d4c656e6774683a2032320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a0000010001001010000001002000680400001600", "emulator_response_len": 130, "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "ico", "http_ua_hash": "2cce74947ae104861c6404693b60cc04c0330b1d", "http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349", "http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 176, "payload_entropy": 5.2055424095882366, "port_category": "well_known", "org": "Internap Holding LLC", "service": "http", "app_proto": "http", "asn": 32475, "country": "US", "dst_port": 81, "risk_waf": 84, "risk_classification": 84, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.4, "risk_breakdown": { "waf": 84, "classification": 84, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15 }, "risk_score": 54, "tag_count": 4, "anomaly_count": 0, "campaign_key": "bb97435c8401b0be42dcb2d3008f87f2e964933a", "event_fingerprint": "33636069ed8fad357698ac0befbec2186370ead0", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "confidence": 0.5, "classification_confidence": 0.5, "precision_score": 55, "precision_signals": [ "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 84, "classification": 84, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 54 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 32475, "org": "Internap Holding LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "83dce64baa2f0543cbc5015d0224fa45", "payload_hash": "d56ec1d099a290ccb29eb2acc5ada1e0", "path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a" }, "target_context": { "dst_port": 81, "service": "http", "service_name": "http", "risk_score": 54 }, "payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/sc", "method": "GET", "path": "\/favicon.ico", "user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/favicon.ico HTTP\/1.1", "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/sc", "evidence": { "method": "GET", "path": "\/favicon.ico", "user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/favicon.ico HTTP\/1.1", "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/sc", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e70c8255b723b38ec0646388f328c24678f0bd77", "protocol_details": { "http_method": "GET", "http_path": "\/favicon.ico", "request_line": "GET \/favicon.ico HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "port": 81, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/sc", "attack_vector": "ssrf attack \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/favicon.ico", "target_port_label": "81 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP", "confidence_pct": 50, "confidence_breakdown": { "waf": 84, "classification": 84, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 54 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 54, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 81, "protocol_emulated": true, "tags_summary": [ "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "http_method": "GET", "http_path": "\/favicon.ico", "request_line": "GET \/favicon.ico HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "port": 81, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "ssrf attack \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/favicon.ico", "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/sc", "target_port_label": "81 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 84 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "81" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "net_web_probe" ] }
15/07/2026 06:29:36 UTC	TCP	12 · TLS	tls	Sonde PostgreSQL postgres probe · via TLS:12 · (sonde / probe)	Moyenne	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole JA3 725543c78edf6691 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 12 Chemin / cible — Service TLS Payload ��" 02!� &[��8\|��K 枾m :��ι�\|�v]��󒎑)῍�(JO�� +�/�,�0̨̩� �� c � Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 57% Corrélation +8 Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��"02!�&[��8\|��K枾m :��ι�\|�v]��󒎑)῍�(JO�� +�/�,�0̨̩� �� c� Requête brute (extrait) ��" 02!� &[��8\|��K 枾m :��ι�\|�v]��󒎑)῍�(JO�� +�/�,�0̨̩� �� c � �� 2+ 3��?� �R:U��sをn; Meta JSON brut { "tls_ja3_hash": "725543c78edf669194c11dc7a039b56e", "tls_sni": null, "bytes_in": 1487, "payload_entropy": 7.7363310890166295, "port_category": "well_known", "org": "Internap Holding LLC", "service": "tls", "app_proto": "tls", "asn": 32475, "country": "US", "dst_port": 12, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.6, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 2, "anomaly_count": 0, "campaign_key": "971d73d6d0f7d51c949f0712984f339d8287500e", "event_fingerprint": "93e6573b3d73794fd3dfe031fd22479bcd01aa2e", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.57, "classification_confidence": 0.57, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 32475, "org": "Internap Holding LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "725543c78edf669194c11dc7a039b56e", "payload_hash": "05c595d2ed41ca11144c7750a9dff385", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5" }, "target_context": { "dst_port": 12, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\"\u000b02!\u0003\ufffd\u000b\u0010\u0002&[\ufffd\ufffd\ufffd\ufffd8\|\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdK\f\u67bem :\ufffd\ufffd\ufffd\u03b9\ufffd\|\ufffdv]\u0002\ufffd\ufffd\udb08\udf91)\u1fcd\ufffd(JO\ufffd\ufffd\r\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\"\u000b02!\u0003\ufffd\u000b\u0010\u0002&[\ufffd\ufffd\ufffd\ufffd8\|\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdK\f\u67bem :\ufffd\ufffd\ufffd\u03b9\ufffd\|\ufffdv]\u0002\ufffd\ufffd\udb08\udf91)\u1fcd\ufffd(JO\ufffd\ufffd\r\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\u0010\u0000\u000e\u0011\ufffd\u0011\ufffd\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd?\ufffd\t\ufffdR\u000f:U\ufffd\ufffd\u0012\u0016\ufffd\u0012s\u3092n\u0014;", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\"\u000b02!\u0003\ufffd\u000b\u0010\u0002&[\ufffd\ufffd\ufffd\ufffd8\|\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdK\f\u67bem :\ufffd\ufffd\ufffd\u03b9\ufffd\|\ufffdv]\u0002\ufffd\ufffd\udb08\udf91)\u1fcd\ufffd(JO\ufffd\ufffd\r\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ff659c2e4661fc8838d066aac45e1531448a1d19", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\"\u000b02!\u0003\ufffd\u000b\u0010\u0002&[\ufffd\ufffd\ufffd\ufffd8\|\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdK\f\u67bem :\ufffd\ufffd\ufffd\u03b9\ufffd\|\ufffdv]\u0002\ufffd\ufffd\udb08\udf91)\u1fcd\ufffd(JO\ufffd\ufffd\r\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "725543c78edf669194c11dc7a039b56e", "port": 12, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\"02!\ufffd&[\ufffd\ufffd\ufffd\ufffd8\|\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdK\u67bem :\ufffd\ufffd\ufffd\u03b9\ufffd\|\ufffdv]\ufffd\ufffd\udb08\udf91)\u1fcd\ufffd(JO\ufffd\ufffd\r\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd", "attack_vector": "postgres probe \u00b7 via TLS:12 \u00b7 (sonde \/ probe)", "target_port_label": "12 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 57, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 12, "protocol_emulated": null, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\"\u000b02!\u0003\ufffd\u000b\u0010\u0002&[\ufffd\ufffd\ufffd\ufffd8\|\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdK\f\u67bem :\ufffd\ufffd\ufffd\u03b9\ufffd\|\ufffdv]\u0002\ufffd\ufffd\udb08\udf91)\u1fcd\ufffd(JO\ufffd\ufffd\r\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "725543c78edf669194c11dc7a039b56e", "port": 12, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "postgres probe \u00b7 via TLS:12 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\"02!\ufffd&[\ufffd\ufffd\ufffd\ufffd8\|\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdK\u67bem :\ufffd\ufffd\ufffd\u03b9\ufffd\|\ufffdv]\ufffd\ufffd\udb08\udf91)\u1fcd\ufffd(JO\ufffd\ufffd\r\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd", "target_port_label": "12 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "12" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni" ] }
15/07/2026 06:29:35 UTC	TCP	12 · HTTP	http	SSRF ssrf attack · via HTTP:12 · (tentative d'exploit)	Élevée	Moyen · 56
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-lab… Émulateur HTTP WAF 22 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 12 Chemin / cible / Service HTTP Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 56 Confiance : Confiance 50 % — 4 tag(s) WAF Signaux Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Règles WAF rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: / Connection: close Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "2cce74947ae104861c6404693b60cc04c0330b1d", "http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 165, "payload_entropy": 5.222494310506847, "port_category": "well_known", "org": "Internap Holding LLC", "service": "http", "app_proto": "http", "asn": 32475, "country": "US", "dst_port": 12, "risk_waf": 96, "risk_classification": 84, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.3, "risk_breakdown": { "waf": 96, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 56, "tag_count": 4, "anomaly_count": 0, "campaign_key": "11e96245e68a6e07eb549d10934878a9c428e528", "event_fingerprint": "9830eb95728ec576c6df2c9bbfc0edda8743d448", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "confidence": 0.5, "classification_confidence": 0.5, "precision_score": 55, "precision_signals": [ "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 96, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 56 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 32475, "org": "Internap Holding LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "83dce64baa2f0543cbc5015d0224fa45", "payload_hash": "25e1dbb9dc3e9dd092f07b00f8ffcace", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 12, "service": "http", "service_name": "http", "risk_score": 56 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "7e2f320f8bd8326ec786a08a1cb7b866dc1d3a5b", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "port": 12, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "attack_vector": "ssrf attack \u00b7 via HTTP:12 \u00b7 (tentative d'exploit)", "target_port_label": "12 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP", "confidence_pct": 50, "confidence_breakdown": { "waf": 96, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 56 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 56, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 12, "protocol_emulated": null, "tags_summary": [ "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "port": 12, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "ssrf attack \u00b7 via HTTP:12 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "target_port_label": "12 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "12" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ] }
15/07/2026 06:16:32 UTC	TCP	88 · KERBEROS	kerberos	Botnet Mozi mozi pattern · via KERBEROS:88 · (commande & contrôle)	Élevée	Faible · 38
Étape Commande & contrôle Chaîne Commande & contrôle Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0011 TA0011 Protocole Émulateur KERBEROS WAF — Recommandation Surveiller Tags http_get_probe mozi_pattern net_mozi_pattern Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 88 Chemin / cible — Service KERBEROS Payload GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info Pourquoi cette classification : Type « mozi_pattern » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 38 Confiance : Confiance 0 % — 3 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0011 Tactiques MITRE TA0011 Motifs de détection (base) LFI Double-dot bypass User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: / Connection: close Meta JSON brut { "protocol_emulated": true, "emulator_response": "6e82000c0a104142434445464748494a", "emulator_response_len": 16, "bytes_in": 165, "payload_entropy": 5.222494310506847, "port_category": "well_known", "org": "Internap Holding LLC", "service": "kerberos", "app_proto": "kerberos", "asn": 32475, "country": "US", "dst_port": 88, "risk_waf": 8, "risk_classification": 82, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 15, "risk_boost": 20, "risk_granularity": 5.2, "risk_breakdown": { "waf": 8, "classification": 82, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 15 }, "risk_score": 38, "tag_count": 3, "anomaly_count": 0, "campaign_key": "68890cc80ee52b8bd6dfeedd3db3b6108c4ecada", "event_fingerprint": "26f82f2c92284ed572a3b340dbd905b8440e59b6", "classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 8, "classification": 82, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 15, "risk_score": 38 }, "named_classification_skipped": false, "service_name": "kerberos", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 32475, "org": "Internap Holding LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "25e1dbb9dc3e9dd092f07b00f8ffcace", "path_pattern_hash": "762d384fab941f6d0c2239f19994f30e" }, "target_context": { "dst_port": 88, "service": "kerberos", "service_name": "kerberos", "risk_score": 38 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "evidence": { "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "c2", "mitre_tactics": [ "TA0011" ], "mitre": "TA0011", "threat_family": [ "botnet" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4516342ed6158bbc86b9e7b2ee02c37d7d4bbe34", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "port": 88, "service": "kerberos", "service_label_fr": "KERBEROS" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "attack_vector": "mozi pattern \u00b7 via KERBEROS:88 \u00b7 (commande & contr\u00f4le)", "target_port_label": "88 \u00b7 KERBEROS", "emulator_service": "kerberos", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 38\/100 (Faible) \u2014 MITRE TA0011 \u2014 via KERBEROS", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 82, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 15, "risk_score": 38 }, "attack_stage": "c2", "attack_stage_label": "Commande & contr\u00f4le", "attack_chain_stage": "command_and_control", "attack_chain_stage_label_fr": "Commande & contr\u00f4le", "risk_score": 38, "risk_label": "Faible", "service_name": "kerberos", "service_label_fr": "KERBEROS", "dst_port": 88, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0011", "mitre_technique": "TA0011", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-kerberos", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "port": 88, "service": "kerberos", "service_label_fr": "KERBEROS" }, "attack_vector": "mozi pattern \u00b7 via KERBEROS:88 \u00b7 (commande & contr\u00f4le)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "target_port_label": "88 \u00b7 KERBEROS", "emulator_service": "kerberos", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": true, "kind": "stage" }, { "key": "command_and_control", "label_fr": "Commande & contr\u00f4le", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "kerberos", "service_banner": "honeypot-kerberos", "service_os": "linux", "dst_port": "88" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "command_and_control", "ban_policy": "advisory_monitor", "tags_list": [ "http_get_probe", "mozi_pattern", "net_mozi_pattern" ] }
15/07/2026 04:35:08 UTC	TCP	4200 · TLS	tls	Sonde PostgreSQL postgres probe · via TLS:4200 · (sonde / probe)	Moyenne	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole JA3 725543c78edf6691 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 4200 Chemin / cible — Service TLS Payload ��˶Q��<)sx��y��;Iw�0-� � � �5��8�W�6\|A��,��u�Sv}�+�/�,�0̨̩� �� c � Pourquoi cette classification :* Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 57% Corrélation +8 Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��˶Q��<)sx��y��;Iw�0-� � � �5��8�W�6\|A��,��u�Sv}�+�/�,�0̨̩� �� c� Requête brute (extrait) ��˶Q��<)sx��y��;Iw�0-� � � �5��8�W�6\|A��,��u�Sv}�+�/�,�0̨̩� �� c � �� 2+ 3��x�NytN�Xi��h�\|�{�$ Meta JSON brut { "tls_ja3_hash": "725543c78edf669194c11dc7a039b56e", "tls_sni": null, "bytes_in": 1487, "payload_entropy": 7.735332509779609, "port_category": "registered", "org": "Internap Holding LLC", "service": "tls", "app_proto": "tls", "asn": 32475, "country": "US", "dst_port": 4200, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.1, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 2, "anomaly_count": 0, "campaign_key": "17685052135433fa0577ccf610891e5eaf5a4b4b", "event_fingerprint": "62f5dc918e7a59f79291d166349daad8737ee77b", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.57, "classification_confidence": 0.57, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 32475, "org": "Internap Holding LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "725543c78edf669194c11dc7a039b56e", "payload_hash": "1280938aeefce4647b48f3e63eb01719", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5" }, "target_context": { "dst_port": 4200, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u02f6Q\ufffd\ufffd<)sx\ufffd\u0017\ufffd\ufffd\u0019y\ufffd\ufffd\ufffd;Iw\ufffd0-\ufffd\u0003\u0012\t\ufffd \ufffd \ufffd\u00105\ufffd\ufffd\u00018\ufffdW\ueac5\ufffd6\|A\ufffd\ufffd,\u0015\ufffd\ufffd\u001a\u000fu\ufffdSv}\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u02f6Q\ufffd\ufffd<)sx\ufffd\u0017\ufffd\ufffd\u0019y\ufffd\ufffd\ufffd;Iw\ufffd0-\ufffd\u0003\u0012\t\ufffd \ufffd \ufffd\u00105\ufffd\ufffd\u00018\ufffdW\ueac5\ufffd6\|A\ufffd\ufffd,\u0015\ufffd\ufffd\u001a\u000fu\ufffdSv}\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\u0010\u0000\u000e\u0011\ufffd\u0011\ufffd\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffdx\ufffdNytN\ufffdXi\u001c\ufffd\u0013\ufffdh\ufffd\|\ufffd{\ufffd$", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u02f6Q\ufffd\ufffd<)sx\ufffd\u0017\ufffd\ufffd\u0019y\ufffd\ufffd\ufffd;Iw\ufffd0-\ufffd\u0003\u0012\t\ufffd \ufffd \ufffd\u00105\ufffd\ufffd\u00018\ufffdW\ueac5\ufffd6\|A\ufffd\ufffd,\u0015\ufffd\ufffd\u001a\u000fu\ufffdSv}\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2e6db94df5e943698d1d91a1def3557570beae3b", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u02f6Q\ufffd\ufffd<)sx\ufffd\u0017\ufffd\ufffd\u0019y\ufffd\ufffd\ufffd;Iw\ufffd0-\ufffd\u0003\u0012\t\ufffd \ufffd \ufffd\u00105\ufffd\ufffd\u00018\ufffdW\ueac5\ufffd6\|A\ufffd\ufffd,\u0015\ufffd\ufffd\u001a\u000fu\ufffdSv}\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "725543c78edf669194c11dc7a039b56e", "port": 4200, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\u02f6Q\ufffd\ufffd<)sx\ufffd\ufffd\ufffdy\ufffd\ufffd\ufffd;Iw\ufffd0-\ufffd\t\ufffd \ufffd \ufffd5\ufffd\ufffd8\ufffdW\ueac5\ufffd6\|A\ufffd\ufffd,\ufffd\ufffdu\ufffdSv}\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd", "attack_vector": "postgres probe \u00b7 via TLS:4200 \u00b7 (sonde \/ probe)", "target_port_label": "4200 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 57, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 4200, "protocol_emulated": null, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u02f6Q\ufffd\ufffd<)sx\ufffd\u0017\ufffd\ufffd\u0019y\ufffd\ufffd\ufffd;Iw\ufffd0-\ufffd\u0003\u0012\t\ufffd \ufffd \ufffd\u00105\ufffd\ufffd\u00018\ufffdW\ueac5\ufffd6\|A\ufffd\ufffd,\u0015\ufffd\ufffd\u001a\u000fu\ufffdSv}\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "725543c78edf669194c11dc7a039b56e", "port": 4200, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "postgres probe \u00b7 via TLS:4200 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\u02f6Q\ufffd\ufffd<)sx\ufffd\ufffd\ufffdy\ufffd\ufffd\ufffd;Iw\ufffd0-\ufffd\t\ufffd \ufffd \ufffd5\ufffd\ufffd*8\ufffdW\ueac5\ufffd6\|A\ufffd\ufffd,\ufffd\ufffdu\ufffdSv}\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd", "target_port_label": "4200 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "4200" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni" ] }
15/07/2026 04:35:07 UTC	TCP	4200 · HTTP	http	SSRF ssrf attack · via HTTP:4200 · (tentative d'exploit)	Élevée	Moyen · 57
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-lab… Émulateur HTTP WAF 22 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 4200 Chemin / cible / Service HTTP Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 57 Confiance : Confiance 50 % — 4 tag(s) WAF Signaux Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Règles WAF rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: / Connection: close Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "2cce74947ae104861c6404693b60cc04c0330b1d", "http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 165, "payload_entropy": 5.222494310506847, "port_category": "registered", "org": "Internap Holding LLC", "service": "http", "app_proto": "http", "asn": 32475, "country": "US", "dst_port": 4200, "risk_waf": 96, "risk_classification": 84, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.8, "risk_breakdown": { "waf": 96, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 57, "tag_count": 4, "anomaly_count": 0, "campaign_key": "8e66fdb0f3a11277552052440031c2e847c08d30", "event_fingerprint": "151f1bed2dca520bcc7444130880b5cc908698f9", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "confidence": 0.5, "classification_confidence": 0.5, "precision_score": 55, "precision_signals": [ "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 96, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 57 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 32475, "org": "Internap Holding LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "83dce64baa2f0543cbc5015d0224fa45", "payload_hash": "25e1dbb9dc3e9dd092f07b00f8ffcace", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 4200, "service": "http", "service_name": "http", "risk_score": 57 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "fa65183b08a8cc92dd7b716393a7e754b423c2ff", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "port": 4200, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "attack_vector": "ssrf attack \u00b7 via HTTP:4200 \u00b7 (tentative d'exploit)", "target_port_label": "4200 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP", "confidence_pct": 50, "confidence_breakdown": { "waf": 96, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 57 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 57, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 4200, "protocol_emulated": null, "tags_summary": [ "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "port": 4200, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "ssrf attack \u00b7 via HTTP:4200 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "target_port_label": "4200 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "4200" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ] }
15/07/2026 00:31:27 UTC	TCP	11 · HTTP	http	SSRF ssrf attack · via HTTP:11 · (tentative d'exploit)	Élevée	Moyen · 56
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-lab… Émulateur HTTP WAF 22 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 11 Chemin / cible / Service HTTP Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 56 Confiance : Confiance 50 % — 4 tag(s) WAF Signaux Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Règles WAF rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: / Connection: close Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "2cce74947ae104861c6404693b60cc04c0330b1d", "http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 165, "payload_entropy": 5.222494310506847, "port_category": "well_known", "org": "Internap Holding LLC", "service": "http", "app_proto": "http", "asn": 32475, "country": "US", "dst_port": 11, "risk_waf": 96, "risk_classification": 84, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 96, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 56, "tag_count": 4, "anomaly_count": 0, "campaign_key": "9227f04daf202ce6353e80cc8789aaaf1b74ae1f", "event_fingerprint": "368d4ec9955398f611b6a33ede8516d5bac56780", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "confidence": 0.5, "classification_confidence": 0.5, "precision_score": 55, "precision_signals": [ "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 96, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 56 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 32475, "org": "Internap Holding LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "83dce64baa2f0543cbc5015d0224fa45", "payload_hash": "25e1dbb9dc3e9dd092f07b00f8ffcace", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 11, "service": "http", "service_name": "http", "risk_score": 56 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d6252896da98271d03c2e11199ddecb2076b633b", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "port": 11, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "attack_vector": "ssrf attack \u00b7 via HTTP:11 \u00b7 (tentative d'exploit)", "target_port_label": "11 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP", "confidence_pct": 50, "confidence_breakdown": { "waf": 96, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 56 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 56, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 11, "protocol_emulated": null, "tags_summary": [ "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "port": 11, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "ssrf attack \u00b7 via HTTP:11 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "target_port_label": "11 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "11" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ] }
15/07/2026 00:31:27 UTC	TCP	11 · TLS	tls	Sonde PostgreSQL postgres probe · via TLS:11 · (sonde / probe)	Moyenne	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole JA3 725543c78edf6691 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 11 Chemin / cible — Service TLS Payload ��C�v��:�̨VxZي~�+yWB��5�� ZTf��,� ��z8��ޖ1�؜�� 7�+�/�,�0̨̩� �� c � Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 57% Corrélation +8 Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��C�v��:�̨VxZي~�+yWB��5�� ZTf��,� ��z8��ޖ1�؜�� 7�+�/�,�0̨̩� �� c� Requête brute (extrait) ��C�v��:�̨VxZي~�+yWB��5�� ZTf��,� ��z8��ޖ1�؜�� 7�+�/�,�0̨̩� �� c � �� 2+ 3��f R��W n��4�F4� Meta JSON brut { "tls_ja3_hash": "725543c78edf669194c11dc7a039b56e", "tls_sni": null, "bytes_in": 1487, "payload_entropy": 7.744395850178677, "port_category": "well_known", "org": "Internap Holding LLC", "service": "tls", "app_proto": "tls", "asn": 32475, "country": "US", "dst_port": 11, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.5, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 2, "anomaly_count": 0, "campaign_key": "f6cc89fa379f3cfabce58d509eea64cdae1dd58a", "event_fingerprint": "cee6a05d7a3e06837419e8860546d9e9d22c7145", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.57, "classification_confidence": 0.57, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 32475, "org": "Internap Holding LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "725543c78edf669194c11dc7a039b56e", "payload_hash": "44ef6084f9d6d871e7d8e1407c30fed9", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5" }, "target_context": { "dst_port": 11, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdC\u000f\ufffdv\ufffd\ufffd:\u0019\ufffd\u0328VxZ\u064a~\ufffd+yWB\ufffd\ufffd5\ufffd\ufffd\ufffd\u001a\ufffd\ufffd \u0001ZTf\ufffd\ufffd,\ufffd\n\ufffd\ufffd\u000f\ufffd\u0017z8\u001e\ufffd\ufffd\u07961\ufffd\u061c\u000e\ufffd\ufffd\n7\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdC\u000f\ufffdv\ufffd\ufffd:\u0019\ufffd\u0328VxZ\u064a~\ufffd+yWB\ufffd\ufffd5\ufffd\ufffd\ufffd\u001a\ufffd\ufffd \u0001ZTf\ufffd\ufffd,\ufffd\n\ufffd\ufffd\u000f\ufffd\u0017z8\u001e\ufffd\ufffd\u07961\ufffd\u061c\u000e\ufffd\ufffd\n7\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\u0010\u0000\u000e\u0011\ufffd\u0011\ufffd\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffdf\u0014\t\u0007R\ufffd\ufffdW\u001b\fn\ufffd\ufffd4\ufffdF4\u0012\u0012\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdC\u000f\ufffdv\ufffd\ufffd:\u0019\ufffd\u0328VxZ\u064a~\ufffd+yWB\ufffd\ufffd5\ufffd\ufffd\ufffd\u001a\ufffd\ufffd \u0001ZTf\ufffd\ufffd,\ufffd\n\ufffd\ufffd\u000f\ufffd\u0017z8\u001e\ufffd\ufffd\u07961\ufffd\u061c\u000e\ufffd\ufffd\n7\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "52f0637dfd088487aa368218ff0a5bea58bfd229", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdC\u000f\ufffdv\ufffd\ufffd:\u0019\ufffd\u0328VxZ\u064a~\ufffd+yWB\ufffd\ufffd5\ufffd\ufffd\ufffd\u001a\ufffd\ufffd \u0001ZTf\ufffd\ufffd,\ufffd\n\ufffd\ufffd\u000f\ufffd\u0017z8\u001e\ufffd\ufffd\u07961\ufffd\u061c\u000e\ufffd\ufffd\n7\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "725543c78edf669194c11dc7a039b56e", "port": 11, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffdC\ufffdv\ufffd\ufffd:\ufffd\u0328VxZ\u064a~\ufffd+yWB\ufffd\ufffd5\ufffd\ufffd\ufffd\ufffd\ufffd ZTf\ufffd\ufffd,\ufffd\n\ufffd\ufffd\ufffdz8\ufffd\ufffd\u07961\ufffd\u061c\ufffd\ufffd\n7\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd", "attack_vector": "postgres probe \u00b7 via TLS:11 \u00b7 (sonde \/ probe)", "target_port_label": "11 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 57, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 11, "protocol_emulated": null, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdC\u000f\ufffdv\ufffd\ufffd:\u0019\ufffd\u0328VxZ\u064a~\ufffd+yWB\ufffd\ufffd5\ufffd\ufffd\ufffd\u001a\ufffd\ufffd \u0001ZTf\ufffd\ufffd,\ufffd\n\ufffd\ufffd\u000f\ufffd\u0017z8\u001e\ufffd\ufffd\u07961\ufffd\u061c\u000e\ufffd\ufffd\n7\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "725543c78edf669194c11dc7a039b56e", "port": 11, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "postgres probe \u00b7 via TLS:11 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffdC\ufffdv\ufffd\ufffd:\ufffd\u0328VxZ\u064a~\ufffd+yWB\ufffd\ufffd5\ufffd\ufffd\ufffd\ufffd\ufffd ZTf\ufffd\ufffd,\ufffd\n\ufffd\ufffd\ufffdz8\ufffd\ufffd\u07961\ufffd\u061c\ufffd\ufffd\n7\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd", "target_port_label": "11 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "11" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni" ] }
14/07/2026 23:54:43 UTC	TCP	84 · TLS	tls	Sonde PostgreSQL postgres probe · via TLS:84 · (sonde / probe)	Moyenne	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole JA3 725543c78edf6691 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 84 Chemin / cible — Service TLS Payload ��2�@ly(O��4��aa`=R5�K��9�� tϸ<J8 6�F�-��c�% ��tf�M1�2��+�/�,�0̨̩� �� c � Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 57% Corrélation +8 Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��2�@ly(O��4��aa`=R5�K��9�� tϸ<J8 6�F�-��c�% ��tf�M1�2��+�/�,�0̨̩� �� c� Requête brute (extrait) ��2�@ly(O��4��aa`=R5�K��9�� tϸ<J8 6�F�-��c�% ��tf�M1�2��+�/�,�0̨̩� �� c � �� 2+ 3��j�\�T{ �A �ҷ��K Meta JSON brut { "tls_ja3_hash": "725543c78edf669194c11dc7a039b56e", "tls_sni": null, "bytes_in": 1487, "payload_entropy": 7.734015114097434, "port_category": "well_known", "org": "Internap Holding LLC", "service": "tls", "app_proto": "tls", "asn": 32475, "country": "US", "dst_port": 84, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.2, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 2, "anomaly_count": 0, "campaign_key": "589ac1b2875ffc389a2e70ca230e4aea78a87c98", "event_fingerprint": "14fef06ee6dea7af5bc8ab1d8b7229dfa579fddb", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.57, "classification_confidence": 0.57, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 32475, "org": "Internap Holding LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "725543c78edf669194c11dc7a039b56e", "payload_hash": "dd4a5148abb53efccb17f9ecb35025b4", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5" }, "target_context": { "dst_port": 84, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u00032\ufffd@ly(O\ufffd\ufffd\ufffd\u00024\ufffd\ufffd\u0005aa\u0006`=R5\ufffdK\ufffd\u0007\u0007\ufffd\ufffd9\ufffd\ufffd t\u03f8<J8 6\ufffdF\ufffd-\ufffd\ufffdc\ufffd%\t\ufffd\u0007\ufffd\u0010\ufffdtf\ufffdM1\ufffd2\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u00032\ufffd@ly(O\ufffd\ufffd\ufffd\u00024\ufffd\ufffd\u0005aa\u0006`=R5\ufffdK\ufffd\u0007\u0007\ufffd\ufffd9\ufffd\ufffd t\u03f8<J8 6\ufffdF\ufffd-\ufffd\ufffdc\ufffd%\t\ufffd\u0007\ufffd\u0010\ufffdtf\ufffdM1\ufffd2\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\u0010\u0000\u000e\u0011\ufffd\u0011\ufffd\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffdj\ufffd\\\ufffdT{ \ufffdA\u001a\r\ufffd\u001f\u04b7\ufffd\ufffdK\u0004", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u00032\ufffd@ly(O\ufffd\ufffd\ufffd\u00024\ufffd\ufffd\u0005aa\u0006`=R5\ufffdK\ufffd\u0007\u0007\ufffd\ufffd9\ufffd\ufffd t\u03f8<J8 6\ufffdF\ufffd-\ufffd\ufffdc\ufffd%\t\ufffd\u0007\ufffd\u0010\ufffdtf\ufffdM1\ufffd2\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ce52196db37bdfcf4b93929de799335bbfbd69da", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u00032\ufffd@ly(O\ufffd\ufffd\ufffd\u00024\ufffd\ufffd\u0005aa\u0006`=R5\ufffdK\ufffd\u0007\u0007\ufffd\ufffd9\ufffd\ufffd t\u03f8<J8 6\ufffdF\ufffd-\ufffd\ufffdc\ufffd%\t\ufffd\u0007\ufffd\u0010\ufffdtf\ufffdM1\ufffd2\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "725543c78edf669194c11dc7a039b56e", "port": 84, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd2\ufffd@ly(O\ufffd\ufffd\ufffd4\ufffd\ufffdaa`=R5\ufffdK\ufffd\ufffd\ufffd9\ufffd\ufffd t\u03f8<J8 6\ufffdF\ufffd-\ufffd\ufffdc\ufffd%\t\ufffd\ufffd\ufffdtf\ufffdM1\ufffd2\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd", "attack_vector": "postgres probe \u00b7 via TLS:84 \u00b7 (sonde \/ probe)", "target_port_label": "84 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 57, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 84, "protocol_emulated": null, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u00032\ufffd@ly(O\ufffd\ufffd\ufffd\u00024\ufffd\ufffd\u0005aa\u0006`=R5\ufffdK\ufffd\u0007\u0007\ufffd\ufffd9\ufffd\ufffd t\u03f8<J8 6\ufffdF\ufffd-\ufffd\ufffdc\ufffd%\t\ufffd\u0007\ufffd\u0010\ufffdtf\ufffdM1\ufffd2\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "725543c78edf669194c11dc7a039b56e", "port": 84, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "postgres probe \u00b7 via TLS:84 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd2\ufffd@ly(O\ufffd\ufffd\ufffd4\ufffd\ufffdaa`=R5\ufffdK\ufffd\ufffd\ufffd9\ufffd\ufffd t\u03f8<J8 6\ufffdF\ufffd-\ufffd\ufffdc\ufffd%\t\ufffd\ufffd\ufffdtf\ufffdM1\ufffd2\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd", "target_port_label": "84 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "84" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni" ] }
14/07/2026 23:54:42 UTC	TCP	84 · HTTP	http	SSRF ssrf attack · via HTTP:84 · (tentative d'exploit)	Élevée	Moyen · 58
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-lab… Émulateur HTTP WAF 22 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 84 Chemin / cible / Service HTTP Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 58 Confiance : Confiance 50 % — 4 tag(s) WAF Signaux Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Règles WAF rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: / Connection: close Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "2cce74947ae104861c6404693b60cc04c0330b1d", "http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 165, "payload_entropy": 5.222494310506847, "port_category": "well_known", "org": "Internap Holding LLC", "service": "http", "app_proto": "http", "asn": 32475, "country": "US", "dst_port": 84, "risk_waf": 96, "risk_classification": 84, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.9, "risk_breakdown": { "waf": 96, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 58, "tag_count": 4, "anomaly_count": 0, "campaign_key": "813f4557d9751a8ca3c4b2d8edf0974b25bc893b", "event_fingerprint": "a00dc77812ac28ec4653aadd3c9edcca2332570a", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "confidence": 0.5, "classification_confidence": 0.5, "precision_score": 55, "precision_signals": [ "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 96, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 58 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 32475, "org": "Internap Holding LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "83dce64baa2f0543cbc5015d0224fa45", "payload_hash": "25e1dbb9dc3e9dd092f07b00f8ffcace", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 84, "service": "http", "service_name": "http", "risk_score": 58 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d59b1c2d8e78b927f9506c47136b0cc8fbfd36da", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "port": 84, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "attack_vector": "ssrf attack \u00b7 via HTTP:84 \u00b7 (tentative d'exploit)", "target_port_label": "84 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP", "confidence_pct": 50, "confidence_breakdown": { "waf": 96, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 58 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 58, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 84, "protocol_emulated": null, "tags_summary": [ "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "port": 84, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "ssrf attack \u00b7 via HTTP:84 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "target_port_label": "84 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "84" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ] }
14/07/2026 22:42:06 UTC	TCP	19 · CHARGEN	chargen	Botnet Mozi mozi pattern · via CHARGEN:19 · (commande & contrôle)	Élevée	Faible · 37
Étape Commande & contrôle Chaîne Commande & contrôle Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0011 TA0011 Protocole Émulateur CHARGEN WAF — Recommandation Surveiller Tags http_get_probe mozi_pattern net_mozi_pattern Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 19 Chemin / cible — Service CHARGEN Payload GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info Pourquoi cette classification : Type « mozi_pattern » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 37 Confiance : Confiance 0 % — 3 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0011 Tactiques MITRE TA0011 Motifs de détection (base) LFI Double-dot bypass User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: / Connection: close Meta JSON brut { "protocol_emulated": true, "emulator_response": "4142434445464748494a4b4c4d4e4f505152535455565758595a6162636465666768696a6b6c6d6e6f707172737475767778797a303132333435363738390d0a", "emulator_response_len": 64, "bytes_in": 165, "payload_entropy": 5.222494310506847, "port_category": "well_known", "org": "Internap Holding LLC", "service": "chargen", "app_proto": "chargen", "asn": 32475, "country": "US", "dst_port": 19, "risk_waf": 8, "risk_classification": 82, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 15, "risk_boost": 20, "risk_granularity": 4.1, "risk_breakdown": { "waf": 8, "classification": 82, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 15 }, "risk_score": 37, "tag_count": 3, "anomaly_count": 0, "campaign_key": "4f04671f820e041a42bf2808ed7aa0b6ebd010fe", "event_fingerprint": "e74872f7309216caab523de5e75544334ce9ed0b", "classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 8, "classification": 82, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 15, "risk_score": 37 }, "named_classification_skipped": false, "service_name": "chargen", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 32475, "org": "Internap Holding LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "25e1dbb9dc3e9dd092f07b00f8ffcace", "path_pattern_hash": "762d384fab941f6d0c2239f19994f30e" }, "target_context": { "dst_port": 19, "service": "chargen", "service_name": "chargen", "risk_score": 37 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "evidence": { "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "c2", "mitre_tactics": [ "TA0011" ], "mitre": "TA0011", "threat_family": [ "botnet" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "842af303fdd7e4cfcb419d805ceb0694870fdbb1", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "port": 19, "service": "chargen", "service_label_fr": "CHARGEN" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "attack_vector": "mozi pattern \u00b7 via CHARGEN:19 \u00b7 (commande & contr\u00f4le)", "target_port_label": "19 \u00b7 CHARGEN", "emulator_service": "chargen", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0011 \u2014 via CHARGEN", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 82, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 15, "risk_score": 37 }, "attack_stage": "c2", "attack_stage_label": "Commande & contr\u00f4le", "attack_chain_stage": "command_and_control", "attack_chain_stage_label_fr": "Commande & contr\u00f4le", "risk_score": 37, "risk_label": "Faible", "service_name": "chargen", "service_label_fr": "CHARGEN", "dst_port": 19, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0011", "mitre_technique": "TA0011", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-chargen", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "port": 19, "service": "chargen", "service_label_fr": "CHARGEN" }, "attack_vector": "mozi pattern \u00b7 via CHARGEN:19 \u00b7 (commande & contr\u00f4le)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "target_port_label": "19 \u00b7 CHARGEN", "emulator_service": "chargen", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": true, "kind": "stage" }, { "key": "command_and_control", "label_fr": "Commande & contr\u00f4le", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "chargen", "service_banner": "honeypot-chargen", "service_os": "linux", "dst_port": "19" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "command_and_control", "ban_policy": "advisory_monitor", "tags_list": [ "http_get_probe", "mozi_pattern", "net_mozi_pattern" ] }
14/07/2026 21:41:38 UTC	TCP	6080 · HTTP	http	SSRF ssrf attack · via HTTP:6080 · (tentative d'exploit)	Élevée	Moyen · 55
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-lab… Émulateur HTTP WAF 22 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 6080 Chemin / cible / Service HTTP Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 55 Confiance : Confiance 50 % — 4 tag(s) WAF Signaux Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Règles WAF rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: / Connection: close Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "2cce74947ae104861c6404693b60cc04c0330b1d", "http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 165, "payload_entropy": 5.222494310506847, "port_category": "registered", "org": "Internap Holding LLC", "service": "http", "app_proto": "http", "asn": 32475, "country": "US", "dst_port": 6080, "risk_waf": 96, "risk_classification": 84, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2, "risk_breakdown": { "waf": 96, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 55, "tag_count": 4, "anomaly_count": 0, "campaign_key": "18243ced1592fee7021590121b394031741adf14", "event_fingerprint": "847567897d16f31433389a0dbb498c475c176129", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "confidence": 0.5, "classification_confidence": 0.5, "precision_score": 55, "precision_signals": [ "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 96, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 55 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 32475, "org": "Internap Holding LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "83dce64baa2f0543cbc5015d0224fa45", "payload_hash": "25e1dbb9dc3e9dd092f07b00f8ffcace", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 6080, "service": "http", "service_name": "http", "risk_score": 55 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "752453581c0818bdda3d2a9925edf82e1d148783", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "port": 6080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "attack_vector": "ssrf attack \u00b7 via HTTP:6080 \u00b7 (tentative d'exploit)", "target_port_label": "6080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP", "confidence_pct": 50, "confidence_breakdown": { "waf": 96, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 55 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 55, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 6080, "protocol_emulated": null, "tags_summary": [ "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "port": 6080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "ssrf attack \u00b7 via HTTP:6080 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "target_port_label": "6080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "6080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ] }
14/07/2026 21:41:38 UTC	TCP	6080 · TLS	tls	Sonde PostgreSQL postgres probe · via TLS:6080 · (sonde / probe)	Moyenne	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole JA3 725543c78edf6691 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 6080 Chemin / cible — Service TLS Payload ��g��0v�S�I��,xj�`d^��֗� _Д�YZ��8.��`9��J��޿�+�/�,�0̨̩� �� c � Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 57% Corrélation +8 Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��g��0v�S�I��,xj�`d^��֗� _Д�YZ��8.��`9��J��޿�+�/�,�0̨̩� �� c� Requête brute (extrait) ��g��0v�S�I��,xj�`d^��֗� _Д�YZ��8.��`9��J��޿�+�/�,�0̨̩� �� c � �� 2+ 3��p��%5L_��T�?� Meta JSON brut { "tls_ja3_hash": "725543c78edf669194c11dc7a039b56e", "tls_sni": null, "bytes_in": 1487, "payload_entropy": 7.71335656981869, "port_category": "registered", "org": "Internap Holding LLC", "service": "tls", "app_proto": "tls", "asn": 32475, "country": "US", "dst_port": 6080, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.3, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 2, "anomaly_count": 0, "campaign_key": "afc46624ae5df9bcac5ba3e34a66b44a25dbd52c", "event_fingerprint": "14daca6d43026b3fed52bc5bba37cffeac9a5317", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.57, "classification_confidence": 0.57, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 32475, "org": "Internap Holding LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "725543c78edf669194c11dc7a039b56e", "payload_hash": "53507774dd9b3d4031997cd71b645aad", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5" }, "target_context": { "dst_port": 6080, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u0016\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffd0v\u0015\ufffdS\ufffdI\ufffd\ufffd,xj\ufffd`\u0001d^\u0002\ufffd\ufffd\u0597\ufffd _\u0414\ufffdYZ\ufffd\ufffd8.\u001e\ufffd\ufffd`9\ufffd\u0013\ufffd\u001d\ufffd\ufffd\u0013\ufffd\ufffdJ\ufffd\ufffd\ufffd\ufffd\ufffd\u07bf\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u0016\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffd0v\u0015\ufffdS\ufffdI\ufffd\ufffd,xj\ufffd`\u0001d^\u0002\ufffd\ufffd\u0597\ufffd _\u0414\ufffdYZ\ufffd\ufffd8.\u001e\ufffd\ufffd`9\ufffd\u0013\ufffd\u001d\ufffd\ufffd\u0013\ufffd\ufffdJ\ufffd\ufffd\ufffd\ufffd\ufffd\u07bf\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\u0010\u0000\u000e\u0011\ufffd\u0011\ufffd\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd\ufffd\ufffdp\ufffd\u0006\ufffd%\u00025L_\ufffd\ufffd\ufffd\ufffdT\ufffd?\ufffd\u0005", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u0016\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffd0v\u0015\ufffdS\ufffdI\ufffd\ufffd,xj\ufffd`\u0001d^\u0002\ufffd\ufffd\u0597\ufffd _\u0414\ufffdYZ\ufffd\ufffd8.\u001e\ufffd\ufffd`9\ufffd\u0013\ufffd\u001d\ufffd\ufffd\u0013\ufffd\ufffdJ\ufffd\ufffd\ufffd\ufffd\ufffd\u07bf\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "556e5c655880234358d091c260cb0b4aedc48baa", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u0016\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffd0v\u0015\ufffdS\ufffdI\ufffd\ufffd,xj\ufffd`\u0001d^\u0002\ufffd\ufffd\u0597\ufffd _\u0414\ufffdYZ\ufffd\ufffd8.\u001e\ufffd\ufffd`9\ufffd\u0013\ufffd\u001d\ufffd\ufffd\u0013\ufffd\ufffdJ\ufffd\ufffd\ufffd\ufffd\ufffd\u07bf\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "725543c78edf669194c11dc7a039b56e", "port": 6080, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffd0v\ufffdS\ufffdI\ufffd\ufffd,xj\ufffd`d^\ufffd\ufffd\u0597\ufffd _\u0414\ufffdYZ\ufffd\ufffd8.\ufffd\ufffd`9\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffd\ufffd\ufffd\ufffd\u07bf\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd", "attack_vector": "postgres probe \u00b7 via TLS:6080 \u00b7 (sonde \/ probe)", "target_port_label": "6080 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 57, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 6080, "protocol_emulated": null, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u0016\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffd0v\u0015\ufffdS\ufffdI\ufffd\ufffd,xj\ufffd`\u0001d^\u0002\ufffd\ufffd\u0597\ufffd _\u0414\ufffdYZ\ufffd\ufffd8.\u001e\ufffd\ufffd`9\ufffd\u0013\ufffd\u001d\ufffd\ufffd\u0013\ufffd\ufffdJ\ufffd\ufffd\ufffd\ufffd\ufffd\u07bf\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "725543c78edf669194c11dc7a039b56e", "port": 6080, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "postgres probe \u00b7 via TLS:6080 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffd0v\ufffdS\ufffdI\ufffd\ufffd,xj\ufffd`d^\ufffd\ufffd\u0597\ufffd _\u0414\ufffdYZ\ufffd\ufffd8.\ufffd\ufffd`9\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffd\ufffd\ufffd\ufffd\u07bf\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd", "target_port_label": "6080 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "6080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni" ] }
14/07/2026 20:27:57 UTC	TCP	5 · HTTP	http	SSRF ssrf attack · via HTTP:5 · (tentative d'exploit)	Élevée	Moyen · 55
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-lab… Émulateur HTTP WAF 22 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5 Chemin / cible / Service HTTP Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 55 Confiance : Confiance 50 % — 4 tag(s) WAF Signaux Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Règles WAF rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: / Connection: close Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "2cce74947ae104861c6404693b60cc04c0330b1d", "http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 165, "payload_entropy": 5.222494310506847, "port_category": "well_known", "org": "Internap Holding LLC", "service": "http", "app_proto": "http", "asn": 32475, "country": "US", "dst_port": 5, "risk_waf": 96, "risk_classification": 84, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.2, "risk_breakdown": { "waf": 96, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 55, "tag_count": 4, "anomaly_count": 0, "campaign_key": "b6f89fe1bb4f6c93a9a68b53f28a63f1c2d59e1c", "event_fingerprint": "e0b4d068221d243d11ea5b1f0ec3b334ecfb7e29", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "confidence": 0.5, "classification_confidence": 0.5, "precision_score": 55, "precision_signals": [ "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 96, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 55 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 32475, "org": "Internap Holding LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "83dce64baa2f0543cbc5015d0224fa45", "payload_hash": "25e1dbb9dc3e9dd092f07b00f8ffcace", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 5, "service": "http", "service_name": "http", "risk_score": 55 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "97885d80f5674e5eb0d11f39ad9454abfa324f20", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "port": 5, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "attack_vector": "ssrf attack \u00b7 via HTTP:5 \u00b7 (tentative d'exploit)", "target_port_label": "5 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP", "confidence_pct": 50, "confidence_breakdown": { "waf": 96, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 55 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 55, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5, "protocol_emulated": null, "tags_summary": [ "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "port": 5, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "ssrf attack \u00b7 via HTTP:5 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "target_port_label": "5 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ] }
14/07/2026 20:27:57 UTC	TCP	5 · TLS	tls	Sonde PostgreSQL postgres probe · via TLS:5 · (sonde / probe)	Moyenne	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole JA3 725543c78edf6691 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5 Chemin / cible — Service TLS Payload ��<�R^ r�m4�ȝ��;1�G� ]DJ��䕙 � 2�ޤ�&��+�t$ZO�G~��[A&�B��+�/�,�0̨̩� �� c � Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 57% Corrélation +8 Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��<�R^r�m4�ȝ��;1�G� ]DJ��䕙 � 2�ޤ�&��+�t$ZO�G~��[A&�B��+�/�,�0̨̩� �� c� Requête brute (extrait) ��<�R^ r�m4�ȝ��;1�G� ]DJ��䕙 � 2�ޤ�&��+�t$ZO�G~��[A&�B��+�/�,�0̨̩� �� c � �� 2+ 3��<WIY2s��0�2Th Meta JSON brut { "tls_ja3_hash": "725543c78edf669194c11dc7a039b56e", "tls_sni": null, "bytes_in": 1487, "payload_entropy": 7.745624660223249, "port_category": "well_known", "org": "Internap Holding LLC", "service": "tls", "app_proto": "tls", "asn": 32475, "country": "US", "dst_port": 5, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.5, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 2, "anomaly_count": 0, "campaign_key": "9050334b46a5eba6a67d74830c9abf80c9f238c7", "event_fingerprint": "572d8998cb9d8f4062077b4195e10e8931d5b073", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.57, "classification_confidence": 0.57, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 32475, "org": "Internap Holding LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "725543c78edf669194c11dc7a039b56e", "payload_hash": "d23350b4246667d92092053c6f7102f8", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5" }, "target_context": { "dst_port": 5, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003<\u001b\ufffdR^\fr\ufffdm4\ufffd\u021d\u0012\ufffd\ufffd;1\ufffdG\ufffd\f\r\u000f]DJ\ufffd\ufffd\u4559 \ufffd 2\ufffd\u0012\u07a4\ufffd&\ufffd\ufffd+\ufffdt\u0006$ZO\ufffdG~\ufffd\ufffd\ufffd\u0011[A&\ufffdB\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003<\u001b\ufffdR^\fr\ufffdm4\ufffd\u021d\u0012\ufffd\ufffd;1\ufffdG\ufffd\f\r\u000f]DJ\ufffd\ufffd\u4559 \ufffd 2\ufffd\u0012\u07a4\ufffd&\ufffd\ufffd+\ufffdt\u0006$ZO\ufffdG~\ufffd\ufffd\ufffd\u0011[A&\ufffdB\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\u0010\u0000\u000e\u0011\ufffd\u0011\ufffd\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd\u0016\ufffd<WIY2s\ufffd\u0013\u001e\ufffd\ufffd\ufffd0\ufffd2Th\u001e", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003<\u001b\ufffdR^\fr\ufffdm4\ufffd\u021d\u0012\ufffd\ufffd;1\ufffdG\ufffd\f\r\u000f]DJ\ufffd\ufffd\u4559 \ufffd 2\ufffd\u0012\u07a4\ufffd&\ufffd\ufffd+\ufffdt\u0006$ZO\ufffdG~\ufffd\ufffd\ufffd\u0011[A&\ufffdB\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c1b5511aa0b43252b4c5f224c1817127a0ab66ef", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003<\u001b\ufffdR^\fr\ufffdm4\ufffd\u021d\u0012\ufffd\ufffd;1\ufffdG\ufffd\f\r\u000f]DJ\ufffd\ufffd\u4559 \ufffd 2\ufffd\u0012\u07a4\ufffd&\ufffd\ufffd+\ufffdt\u0006$ZO\ufffdG~\ufffd\ufffd\ufffd\u0011[A&\ufffdB\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "725543c78edf669194c11dc7a039b56e", "port": 5, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd<\ufffdR^r\ufffdm4\ufffd\u021d\ufffd\ufffd;1\ufffdG\ufffd\r]DJ\ufffd\ufffd\u4559 \ufffd 2\ufffd\u07a4\ufffd&\ufffd\ufffd+\ufffdt$ZO\ufffdG~\ufffd\ufffd\ufffd[A&\ufffdB\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd", "attack_vector": "postgres probe \u00b7 via TLS:5 \u00b7 (sonde \/ probe)", "target_port_label": "5 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 57, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 5, "protocol_emulated": null, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003<\u001b\ufffdR^\fr\ufffdm4\ufffd\u021d\u0012\ufffd\ufffd;1\ufffdG\ufffd\f\r\u000f]DJ\ufffd\ufffd\u4559 \ufffd 2\ufffd\u0012\u07a4\ufffd&\ufffd\ufffd+\ufffdt\u0006$ZO\ufffdG~\ufffd\ufffd\ufffd\u0011[A&\ufffdB\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "725543c78edf669194c11dc7a039b56e", "port": 5, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "postgres probe \u00b7 via TLS:5 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd<\ufffdR^r\ufffdm4\ufffd\u021d\ufffd\ufffd;1\ufffdG\ufffd\r]DJ\ufffd\ufffd\u4559 \ufffd 2\ufffd\u07a4\ufffd&\ufffd\ufffd+\ufffdt$ZO\ufffdG~\ufffd\ufffd\ufffd[A&\ufffdB\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd", "target_port_label": "5 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "5" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni" ] }
14/07/2026 19:46:48 UTC	TCP	8443 · HTTPS	https	Botnet Mozi mozi pattern · via HTTPS:8443 · (commande & contrôle)	Élevée	Faible · 36
Étape Commande & contrôle Chaîne Commande & contrôle Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0011 TA0011 Protocole Émulateur HTTPS WAF — Recommandation Surveiller Tags http_alt_port http_get_probe mozi_pattern net_web_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8443 Chemin / cible — Service HTTPS Payload GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info Pourquoi cette classification : Type « mozi_pattern » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 36 Confiance : Confiance 0 % — 4 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0011 Tactiques MITRE TA0011 Motifs de détection (base) LFI Double-dot bypass User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: / Connection: close Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 165, "payload_entropy": 5.222494310506847, "port_category": "registered", "org": "Internap Holding LLC", "service": "https", "app_proto": "https", "asn": 32475, "country": "US", "dst_port": 8443, "risk_waf": 8, "risk_classification": 82, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 20, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 82, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15 }, "risk_score": 36, "tag_count": 4, "anomaly_count": 0, "campaign_key": "2aa17a6b515596b20eaea8d57184d62da9f48dfc", "event_fingerprint": "48aa5a12dd4150e072f6d3dd03f9143ac67f8d69", "classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 8, "classification": 82, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 36 }, "named_classification_skipped": false, "service_name": "https", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 32475, "org": "Internap Holding LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "25e1dbb9dc3e9dd092f07b00f8ffcace", "path_pattern_hash": "762d384fab941f6d0c2239f19994f30e" }, "target_context": { "dst_port": 8443, "service": "https", "service_name": "https", "risk_score": 36 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "evidence": { "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "c2", "mitre_tactics": [ "TA0011" ], "mitre": "TA0011", "threat_family": [ "botnet" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3386d8276d2322c532a0b29886bcbe687c3da254", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "port": 8443, "service": "https", "service_label_fr": "HTTPS" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "attack_vector": "mozi pattern \u00b7 via HTTPS:8443 \u00b7 (commande & contr\u00f4le)", "target_port_label": "8443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 36\/100 (Faible) \u2014 MITRE TA0011 \u2014 via HTTPS", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 82, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 36 }, "attack_stage": "c2", "attack_stage_label": "Commande & contr\u00f4le", "attack_chain_stage": "command_and_control", "attack_chain_stage_label_fr": "Commande & contr\u00f4le", "risk_score": 36, "risk_label": "Faible", "service_name": "https", "service_label_fr": "HTTPS", "dst_port": 8443, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0011", "mitre_technique": "TA0011", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-https", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "port": 8443, "service": "https", "service_label_fr": "HTTPS" }, "attack_vector": "mozi pattern \u00b7 via HTTPS:8443 \u00b7 (commande & contr\u00f4le)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "target_port_label": "8443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": true, "kind": "stage" }, { "key": "command_and_control", "label_fr": "Commande & contr\u00f4le", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "https", "service_banner": "honeypot-https", "service_os": "linux", "dst_port": "8443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "command_and_control", "ban_policy": "advisory_monitor", "tags_list": [ "http_alt_port", "http_get_probe", "mozi_pattern", "net_web_probe" ] }
14/07/2026 19:46:48 UTC	TCP	8443 · HTTPS	https	Botnet Mozi mozi pattern · via HTTPS:8443 · (commande & contrôle)	Élevée	Faible · 36
Étape Commande & contrôle Chaîne Commande & contrôle Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0011 TA0011 Protocole Émulateur HTTPS WAF — Recommandation Surveiller Tags http_alt_port http_get_probe mozi_pattern net_web_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8443 Chemin / cible — Service HTTPS Payload GET /favicon.ico HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/sc Pourquoi cette classification : Type « mozi_pattern » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 36 Confiance : Confiance 0 % — 4 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0011 Tactiques MITRE TA0011 Motifs de détection (base) LFI Double-dot bypass User-Agent — Règles WAF — Payload (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/sc Requête brute (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: / Connection: close Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d547970653a20696d6167652f782d69636f6e0d0a436f6e74656e742d4c656e6774683a2032320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a0000010001001010000001002000680400001600", "emulator_response_len": 130, "bytes_in": 176, "payload_entropy": 5.2055424095882366, "port_category": "registered", "org": "Internap Holding LLC", "service": "https", "app_proto": "https", "asn": 32475, "country": "US", "dst_port": 8443, "risk_waf": 8, "risk_classification": 82, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 20, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 82, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15 }, "risk_score": 36, "tag_count": 4, "anomaly_count": 0, "campaign_key": "2aa17a6b515596b20eaea8d57184d62da9f48dfc", "event_fingerprint": "48aa5a12dd4150e072f6d3dd03f9143ac67f8d69", "classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 8, "classification": 82, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 36 }, "named_classification_skipped": false, "service_name": "https", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 32475, "org": "Internap Holding LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d56ec1d099a290ccb29eb2acc5ada1e0", "path_pattern_hash": "762d384fab941f6d0c2239f19994f30e" }, "target_context": { "dst_port": 8443, "service": "https", "service_name": "https", "risk_score": 36 }, "payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/sc", "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/sc", "evidence": { "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/sc", "classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "c2", "mitre_tactics": [ "TA0011" ], "mitre": "TA0011", "threat_family": [ "botnet" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "91fc357fd71fd242b6eb0a3a86907107e9091bb5", "protocol_details": { "payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/sc", "port": 8443, "service": "https", "service_label_fr": "HTTPS" }, "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/sc", "attack_vector": "mozi pattern \u00b7 via HTTPS:8443 \u00b7 (commande & contr\u00f4le)", "target_port_label": "8443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 36\/100 (Faible) \u2014 MITRE TA0011 \u2014 via HTTPS", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 82, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 36 }, "attack_stage": "c2", "attack_stage_label": "Commande & contr\u00f4le", "attack_chain_stage": "command_and_control", "attack_chain_stage_label_fr": "Commande & contr\u00f4le", "risk_score": 36, "risk_label": "Faible", "service_name": "https", "service_label_fr": "HTTPS", "dst_port": 8443, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0011", "mitre_technique": "TA0011", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-https", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/sc", "port": 8443, "service": "https", "service_label_fr": "HTTPS" }, "attack_vector": "mozi pattern \u00b7 via HTTPS:8443 \u00b7 (commande & contr\u00f4le)", "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/sc", "target_port_label": "8443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": true, "kind": "stage" }, { "key": "command_and_control", "label_fr": "Commande & contr\u00f4le", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "https", "service_banner": "honeypot-https", "service_os": "linux", "dst_port": "8443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "command_and_control", "ban_policy": "advisory_monitor", "tags_list": [ "http_alt_port", "http_get_probe", "mozi_pattern", "net_web_probe" ] }
14/07/2026 18:53:17 UTC	TCP	18 · HTTP	http	SSRF ssrf attack · via HTTP:18 · (tentative d'exploit)	Élevée	Moyen · 57
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-lab… Émulateur HTTP WAF 22 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 18 Chemin / cible / Service HTTP Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 57 Confiance : Confiance 50 % — 4 tag(s) WAF Signaux Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Règles WAF rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: / Connection: close Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "2cce74947ae104861c6404693b60cc04c0330b1d", "http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 165, "payload_entropy": 5.222494310506847, "port_category": "well_known", "org": "Internap Holding LLC", "service": "http", "app_proto": "http", "asn": 32475, "country": "US", "dst_port": 18, "risk_waf": 96, "risk_classification": 84, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.3, "risk_breakdown": { "waf": 96, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 57, "tag_count": 4, "anomaly_count": 0, "campaign_key": "cd7ea962c800e17cb1cd7d80f3e56968f8b7ee6d", "event_fingerprint": "2b246b80fef51e242b5261c906b8ea00a47c9a34", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "confidence": 0.5, "classification_confidence": 0.5, "precision_score": 55, "precision_signals": [ "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 96, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 57 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 32475, "org": "Internap Holding LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "83dce64baa2f0543cbc5015d0224fa45", "payload_hash": "25e1dbb9dc3e9dd092f07b00f8ffcace", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 18, "service": "http", "service_name": "http", "risk_score": 57 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5acf13e518cddef184be8659e0d24bbb100030bf", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "port": 18, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "attack_vector": "ssrf attack \u00b7 via HTTP:18 \u00b7 (tentative d'exploit)", "target_port_label": "18 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP", "confidence_pct": 50, "confidence_breakdown": { "waf": 96, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 57 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 57, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 18, "protocol_emulated": null, "tags_summary": [ "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "port": 18, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "ssrf attack \u00b7 via HTTP:18 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "target_port_label": "18 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "18" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ] }
14/07/2026 18:53:17 UTC	TCP	18 · TLS	tls	Sonde PostgreSQL postgres probe · via TLS:18 · (sonde / probe)	Moyenne	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole JA3 725543c78edf6691 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 18 Chemin / cible — Service TLS Payload ��R��j!�.��a�em� B�<�s��Z�� T��?��ô} }��R��j��I�+�/�,�0̨̩� �� c � Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 57% Corrélation +8 Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��R��j!�.��a�em� B�<�s��Z�� T��?��ô} }��R��j��I�+�/�,�0̨̩� �� c� Requête brute (extrait) ��R��j!�.��a�em� B�<�s��Z�� T��?��ô} }��R��j��I�+�/�,�0̨̩� �� c � �� 2+ 3��_\|��yrd\; ozYP�y Meta JSON brut { "tls_ja3_hash": "725543c78edf669194c11dc7a039b56e", "tls_sni": null, "bytes_in": 1487, "payload_entropy": 7.7477857855083885, "port_category": "well_known", "org": "Internap Holding LLC", "service": "tls", "app_proto": "tls", "asn": 32475, "country": "US", "dst_port": 18, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.6, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 2, "anomaly_count": 0, "campaign_key": "0fd77233a834c2658dd40199c3407c31597d3dcc", "event_fingerprint": "5c7e9d6fac989aac3a0b6e720d08f6df3a2c6593", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.57, "classification_confidence": 0.57, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 32475, "org": "Internap Holding LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "725543c78edf669194c11dc7a039b56e", "payload_hash": "11e92f89fb1ea72f0c82a087b92bc683", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5" }, "target_context": { "dst_port": 18, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdR\u0000\ufffd\ufffdj!\ufffd\u0002.\ufffd\ufffd\ufffda\u0004\ufffdem\ufffd\nB\ufffd<\ufffds\ufffd\ufffdZ\ufffd\ufffd\ufffd\u000e \ufffd\ufffd\u0000\ufffdT\ufffd\ufffd?\ufffd\u001c\ufffd\u00f4}\u0005\t\u0014}\ufffd\ufffd\u001b\u0001R\ufffd\ufffd\u0016\ufffd\u0002j\ufffd\ufffdI\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdR\u0000\ufffd\ufffdj!\ufffd\u0002.\ufffd\ufffd\ufffda\u0004\ufffdem\ufffd\nB\ufffd<\ufffds\ufffd\ufffdZ\ufffd\ufffd\ufffd\u000e \ufffd\ufffd\u0000\ufffdT\ufffd\ufffd?\ufffd\u001c\ufffd\u00f4}\u0005\t\u0014}\ufffd\ufffd\u001b\u0001R\ufffd\ufffd\u0016\ufffd\u0002j\ufffd\ufffdI\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\u0010\u0000\u000e\u0011\ufffd\u0011\ufffd\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd\u0014_\|\ufffd\u000e\ufffd\ufffdyrd\u001f\\; ozYP\ufffdy", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdR\u0000\ufffd\ufffdj!\ufffd\u0002.\ufffd\ufffd\ufffda\u0004\ufffdem\ufffd\nB\ufffd<\ufffds\ufffd\ufffdZ\ufffd\ufffd\ufffd\u000e \ufffd\ufffd\u0000\ufffdT\ufffd\ufffd?\ufffd\u001c\ufffd\u00f4}\u0005\t\u0014}\ufffd\ufffd\u001b\u0001R\ufffd\ufffd\u0016\ufffd\u0002j\ufffd\ufffdI\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0dd46fb9eb161df78b0d8fbd16f8650af2379b26", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdR\u0000\ufffd\ufffdj!\ufffd\u0002.\ufffd\ufffd\ufffda\u0004\ufffdem\ufffd\nB\ufffd<\ufffds\ufffd\ufffdZ\ufffd\ufffd\ufffd\u000e \ufffd\ufffd\u0000\ufffdT\ufffd\ufffd?\ufffd\u001c\ufffd\u00f4}\u0005\t\u0014}\ufffd\ufffd\u001b\u0001R\ufffd\ufffd\u0016\ufffd\u0002j\ufffd\ufffdI\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "725543c78edf669194c11dc7a039b56e", "port": 18, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffdR\ufffd\ufffdj!\ufffd.\ufffd\ufffd\ufffda\ufffdem\ufffd\nB\ufffd<\ufffds\ufffd\ufffdZ\ufffd\ufffd\ufffd \ufffd\ufffd\ufffdT\ufffd\ufffd?\ufffd\ufffd\u00f4}\t}\ufffd\ufffdR\ufffd\ufffd\ufffdj\ufffd\ufffdI\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd", "attack_vector": "postgres probe \u00b7 via TLS:18 \u00b7 (sonde \/ probe)", "target_port_label": "18 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 57, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 18, "protocol_emulated": null, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdR\u0000\ufffd\ufffdj!\ufffd\u0002.\ufffd\ufffd\ufffda\u0004\ufffdem\ufffd\nB\ufffd<\ufffds\ufffd\ufffdZ\ufffd\ufffd\ufffd\u000e \ufffd\ufffd\u0000\ufffdT\ufffd\ufffd?\ufffd\u001c\ufffd\u00f4}\u0005\t\u0014}\ufffd\ufffd\u001b\u0001R\ufffd\ufffd\u0016\ufffd\u0002j\ufffd\ufffdI\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "725543c78edf669194c11dc7a039b56e", "port": 18, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "postgres probe \u00b7 via TLS:18 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffdR\ufffd\ufffdj!\ufffd.\ufffd\ufffd\ufffda\ufffdem\ufffd\nB\ufffd<\ufffds\ufffd\ufffdZ\ufffd\ufffd\ufffd \ufffd\ufffd\ufffdT\ufffd\ufffd?\ufffd\ufffd\u00f4}\t}\ufffd\ufffdR\ufffd\ufffd\ufffdj\ufffd\ufffdI\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd", "target_port_label": "18 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "18" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni" ] }
14/07/2026 17:19:00 UTC	TCP	7564 · HTTP	http	SSRF ssrf attack · via HTTP:7564 · (tentative d'exploit)	Élevée	Moyen · 54
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-lab… Émulateur HTTP WAF 22 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7564 Chemin / cible / Service HTTP Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 54 Confiance : Confiance 50 % — 4 tag(s) WAF Signaux Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Règles WAF rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: / Connection: close Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "2cce74947ae104861c6404693b60cc04c0330b1d", "http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 165, "payload_entropy": 5.222494310506847, "port_category": "registered", "org": "Internap Holding LLC", "service": "http", "app_proto": "http", "asn": 32475, "country": "US", "dst_port": 7564, "risk_waf": 96, "risk_classification": 84, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.4, "risk_breakdown": { "waf": 96, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 54, "tag_count": 4, "anomaly_count": 0, "campaign_key": "6f01412273471c4e158b47d85480141458b8bc33", "event_fingerprint": "7c93a7c17483ddbcb2bc578b1a7b6eeeb2df459d", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "confidence": 0.5, "classification_confidence": 0.5, "precision_score": 55, "precision_signals": [ "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 96, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 54 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 32475, "org": "Internap Holding LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "83dce64baa2f0543cbc5015d0224fa45", "payload_hash": "25e1dbb9dc3e9dd092f07b00f8ffcace", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 7564, "service": "http", "service_name": "http", "risk_score": 54 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e02c4d99ddf0d8190abdea943e48b01957db1daa", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "port": 7564, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "attack_vector": "ssrf attack \u00b7 via HTTP:7564 \u00b7 (tentative d'exploit)", "target_port_label": "7564 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP", "confidence_pct": 50, "confidence_breakdown": { "waf": 96, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 54 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 54, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7564, "protocol_emulated": null, "tags_summary": [ "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "port": 7564, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "ssrf attack \u00b7 via HTTP:7564 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "target_port_label": "7564 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7564" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ] }
14/07/2026 17:19:00 UTC	TCP	7564 · TLS	tls	Sonde PostgreSQL postgres probe · via TLS:7564 · (sonde / probe)	Moyenne	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole JA3 725543c78edf6691 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7564 Chemin / cible — Service TLS Payload ��"�ʂ�esgEo��}�}Р�-�%�B�0�� V�臣�7\|F_Gm��QM�Rj�H�O��;��+�/�,�0̨̩� �� c � Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 57% Corrélation +8 Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��"�ʂ�esgEo��}�}Р�-�%�B�0�� V�臣�7\|F_Gm��QM�Rj�H�O��;��+�/�,�0̨̩� �� c� Requête brute (extrait) ��"�ʂ�esgEo��}�}Р�-�%�B�0�� V�臣�7\|F_Gm��QM�Rj�H�O��;��+�/�,�0̨̩� �� c � �� 2+ 3��I3�Rkh�P6�5~�q��G Meta JSON brut { "tls_ja3_hash": "725543c78edf669194c11dc7a039b56e", "tls_sni": null, "bytes_in": 1487, "payload_entropy": 7.755685473763096, "port_category": "registered", "org": "Internap Holding LLC", "service": "tls", "app_proto": "tls", "asn": 32475, "country": "US", "dst_port": 7564, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 0.7, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 2, "anomaly_count": 0, "campaign_key": "69e4b7bb1fc04c7d76d3e135481568b722cf352d", "event_fingerprint": "b277b39cfac0e03d6112d0d374deba47df9a6deb", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.57, "classification_confidence": 0.57, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 32475, "org": "Internap Holding LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "725543c78edf669194c11dc7a039b56e", "payload_hash": "cfe9877fcfc8b30078cf197a36a3a72e", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5" }, "target_context": { "dst_port": 7564, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\"\ufffd\u0282\ufffdesgEo\ufffd\ufffd\ufffd\ufffd\u0005\ufffd}\ufffd\u0013}\u0420\ufffd-\ufffd%\ufffdB\ufffd0\ufffd\ufffd \ufffd\ufffdV\ufffd\u81e3\ufffd7\|F_Gm\ufffd\ufffd\ufffdQM\ufffdRj\ufffdH\ufffdO\ufffd\ufffd\ufffd\ufffd;\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\"\ufffd\u0282\ufffdesgEo\ufffd\ufffd\ufffd\ufffd\u0005\ufffd}\ufffd\u0013}\u0420\ufffd-\ufffd%\ufffdB\ufffd0\ufffd\ufffd \ufffd\ufffdV\ufffd\u81e3\ufffd7\|F_Gm\ufffd\ufffd\ufffdQM\ufffdRj\ufffdH\ufffdO\ufffd\ufffd\ufffd\ufffd;\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\u0010\u0000\u000e\u0011\ufffd\u0011\ufffd\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\u0000I3\ufffdRkh\ufffdP\uef3b6\ufffd5~\ufffdq\ufffd\ufffdG", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\"\ufffd\u0282\ufffdesgEo\ufffd\ufffd\ufffd\ufffd\u0005\ufffd}\ufffd\u0013}\u0420\ufffd-\ufffd%\ufffdB\ufffd0\ufffd\ufffd \ufffd\ufffdV\ufffd\u81e3\ufffd7\|F_Gm\ufffd\ufffd\ufffdQM\ufffdRj\ufffdH\ufffdO\ufffd\ufffd\ufffd\ufffd;\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e356f34e66ef28ae6ca36c685b36bf1d0d7ee227", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\"\ufffd\u0282\ufffdesgEo\ufffd\ufffd\ufffd\ufffd\u0005\ufffd}\ufffd\u0013}\u0420\ufffd-\ufffd%\ufffdB\ufffd0\ufffd\ufffd \ufffd\ufffdV\ufffd\u81e3\ufffd7\|F_Gm\ufffd\ufffd\ufffdQM\ufffdRj\ufffdH\ufffdO\ufffd\ufffd\ufffd\ufffd;\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "725543c78edf669194c11dc7a039b56e", "port": 7564, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\"\ufffd\u0282\ufffdesgEo\ufffd\ufffd\ufffd\ufffd\ufffd}\ufffd}\u0420\ufffd-\ufffd%\ufffdB\ufffd0\ufffd\ufffd \ufffd\ufffdV\ufffd\u81e3\ufffd7\|F_Gm\ufffd\ufffd\ufffdQM\ufffdRj\ufffdH\ufffdO\ufffd\ufffd\ufffd\ufffd;\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd", "attack_vector": "postgres probe \u00b7 via TLS:7564 \u00b7 (sonde \/ probe)", "target_port_label": "7564 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 57, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 7564, "protocol_emulated": null, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\"\ufffd\u0282\ufffdesgEo\ufffd\ufffd\ufffd\ufffd\u0005\ufffd}\ufffd\u0013}\u0420\ufffd-\ufffd%\ufffdB\ufffd0\ufffd\ufffd \ufffd\ufffdV\ufffd\u81e3\ufffd7\|F_Gm\ufffd\ufffd\ufffdQM\ufffdRj\ufffdH\ufffdO\ufffd\ufffd\ufffd\ufffd;\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "725543c78edf669194c11dc7a039b56e", "port": 7564, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "postgres probe \u00b7 via TLS:7564 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\"\ufffd\u0282\ufffdesgEo\ufffd\ufffd\ufffd\ufffd\ufffd}\ufffd}\u0420\ufffd-\ufffd%\ufffdB\ufffd0\ufffd\ufffd \ufffd\ufffdV\ufffd\u81e3\ufffd7\|F_Gm\ufffd\ufffd\ufffdQM\ufffdRj\ufffdH\ufffdO\ufffd\ufffd\ufffd\ufffd;\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd", "target_port_label": "7564 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "7564" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni" ] }
14/07/2026 16:42:44 UTC	TCP	8008 · HTTP	http	SSRF ssrf attack · via HTTP:8008 · (tentative d'exploit)	Élevée	Moyen · 57
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-lab… Émulateur HTTP WAF 22 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8008 Chemin / cible / Service HTTP Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 57 Confiance : Confiance 50 % — 4 tag(s) WAF Protocole émulé 1 Signaux Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Règles WAF rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: / Connection: close Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "2cce74947ae104861c6404693b60cc04c0330b1d", "http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 165, "payload_entropy": 5.222494310506847, "port_category": "registered", "org": "Internap Holding LLC", "service": "http", "app_proto": "http", "asn": 32475, "country": "US", "dst_port": 8008, "risk_waf": 96, "risk_classification": 84, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 96, "classification": 84, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25 }, "risk_score": 57, "tag_count": 5, "anomaly_count": 0, "campaign_key": "0b5a411189e9809bc6963f077aef6253d3178d69", "event_fingerprint": "3f58ca66b82e590e58f688047fd9f0853aa32d5b", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "confidence": 0.5, "classification_confidence": 0.5, "precision_score": 55, "precision_signals": [ "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 96, "classification": 84, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 57 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 32475, "org": "Internap Holding LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "83dce64baa2f0543cbc5015d0224fa45", "payload_hash": "25e1dbb9dc3e9dd092f07b00f8ffcace", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 8008, "service": "http", "service_name": "http", "risk_score": 57 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f243695505149210d0885d113f3cd31918a57b58", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "port": 8008, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "attack_vector": "ssrf attack \u00b7 via HTTP:8008 \u00b7 (tentative d'exploit)", "target_port_label": "8008 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP", "confidence_pct": 50, "confidence_breakdown": { "waf": 96, "classification": 84, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 57 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 57, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8008, "protocol_emulated": true, "tags_summary": [ "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "port": 8008, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "ssrf attack \u00b7 via HTTP:8008 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "target_port_label": "8008 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8008" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path", "net_web_probe" ] }
14/07/2026 16:42:44 UTC	TCP	8008 · HTTP	http	SSRF ssrf attack · via HTTP:8008 · (tentative d'exploit) · → /favicon.ico	Élevée	Moyen · 52
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole GET /favicon.ico UA Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-lab… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 net_web_probe Cible HTTP GET /favicon.ico TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8008 Chemin / cible /favicon.ico Service HTTP Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 52 Confiance : Confiance 50 % — 3 tag(s) WAF Protocole émulé 1 Signaux Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET /favicon.ico HTTP/1.1` User-Agent Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/sc Requête brute (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: / Connection: close Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d547970653a20696d6167652f782d69636f6e0d0a436f6e74656e742d4c656e6774683a2032320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a0000010001001010000001002000680400001600", "emulator_response_len": 130, "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "ico", "http_ua_hash": "2cce74947ae104861c6404693b60cc04c0330b1d", "http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349", "http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 176, "payload_entropy": 5.2055424095882366, "port_category": "registered", "org": "Internap Holding LLC", "service": "http", "app_proto": "http", "asn": 32475, "country": "US", "dst_port": 8008, "risk_waf": 84, "risk_classification": 84, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3, "risk_breakdown": { "waf": 84, "classification": 84, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15 }, "risk_score": 52, "tag_count": 4, "anomaly_count": 0, "campaign_key": "46a3e466effc650db7a83e0364ece1385db7ed30", "event_fingerprint": "73f66f70b328f66e69718adcdd4c9badc8835a18", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "confidence": 0.5, "classification_confidence": 0.5, "precision_score": 55, "precision_signals": [ "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 84, "classification": 84, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 52 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 32475, "org": "Internap Holding LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "83dce64baa2f0543cbc5015d0224fa45", "payload_hash": "d56ec1d099a290ccb29eb2acc5ada1e0", "path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a" }, "target_context": { "dst_port": 8008, "service": "http", "service_name": "http", "risk_score": 52 }, "payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/sc", "method": "GET", "path": "\/favicon.ico", "user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/favicon.ico HTTP\/1.1", "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/sc", "evidence": { "method": "GET", "path": "\/favicon.ico", "user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/favicon.ico HTTP\/1.1", "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/sc", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3dcce1922f6c17fe53e7256370d0d56b4eca6561", "protocol_details": { "http_method": "GET", "http_path": "\/favicon.ico", "request_line": "GET \/favicon.ico HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "port": 8008, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/sc", "attack_vector": "ssrf attack \u00b7 via HTTP:8008 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/favicon.ico", "target_port_label": "8008 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP", "confidence_pct": 50, "confidence_breakdown": { "waf": 84, "classification": 84, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 52 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 52, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8008, "protocol_emulated": true, "tags_summary": [ "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "http_method": "GET", "http_path": "\/favicon.ico", "request_line": "GET \/favicon.ico HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "port": 8008, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "ssrf attack \u00b7 via HTTP:8008 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/favicon.ico", "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/sc", "target_port_label": "8008 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 84 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8008" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "net_web_probe" ] }
14/07/2026 15:14:32 UTC	TCP	23456 · TLS	tls	Sonde PostgreSQL postgres probe · via TLS:23456 · (sonde / probe)	Moyenne	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole JA3 725543c78edf6691 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 23456 Chemin / cible — Service TLS Payload ��q�� 5 � !H��4Q��( SB�l�/� �c(��ǷW`zǼ�QF}�W�2�z��%�ɪ�+�/�,�0̨̩� �� c � Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 57% Corrélation +8 Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��q�� 5 � !H��4Q��( SB�l�/� �c(��ǷW`zǼ�QF}�W�2�z��%�ɪ�+�/�,�0̨̩� �� c� Requête brute (extrait) ��q�� 5 � !H��4Q��( SB�l�/� �c(��ǷW`zǼ�QF}�W�2�z��%�ɪ�+�/�,�0̨̩� �� c � �� 2+ 3��W4v�<��7ghD#I�9o Meta JSON brut { "tls_ja3_hash": "725543c78edf669194c11dc7a039b56e", "tls_sni": null, "bytes_in": 1487, "payload_entropy": 7.7324138659306865, "port_category": "registered", "org": "Internap Holding LLC", "service": "tls", "app_proto": "tls", "asn": 32475, "country": "US", "dst_port": 23456, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.9, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 2, "anomaly_count": 0, "campaign_key": "9722c3e4519d9b7915efbe946df485705424647b", "event_fingerprint": "a6f0c0833e70ae850f75400c6739ba4b2b2b76ad", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.57, "classification_confidence": 0.57, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 32475, "org": "Internap Holding LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "725543c78edf669194c11dc7a039b56e", "payload_hash": "0b01ba48fd472bb7109f51baed98bcce", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5" }, "target_context": { "dst_port": 23456, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffdq\ufffd\ufffd\n\u00115 \ufffd\r!H\u0018\ufffd\ufffd\ufffd\ufffd4Q\ufffd\ufffd(\rS\u001bB\ufffdl\ufffd\/\ufffd \ufffdc(\ufffd\ufffd\u0019\u01f7W`z\u01fc\ufffd\u001cQF}\ufffd\u0011W\ufffd2\ufffdz\ufffd\ufffd\u001c%\ufffd\u026a\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffdq\ufffd\ufffd\n\u00115 \ufffd\r!H\u0018\ufffd\ufffd\ufffd\ufffd4Q\ufffd\ufffd(\rS\u001bB\ufffdl\ufffd\/\ufffd \ufffdc(\ufffd\ufffd\u0019\u01f7W`z\u01fc\ufffd\u001cQF}\ufffd\u0011W\ufffd2\ufffdz\ufffd\ufffd\u001c%\ufffd\u026a\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\u0010\u0000\u000e\u0011\ufffd\u0011\ufffd\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\u0017W4v\ufffd<\u0017\ufffd\u0000\u0013\ufffd\ufffd7ghD#I\ufffd9o", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffdq\ufffd\ufffd\n\u00115 \ufffd\r!H\u0018\ufffd\ufffd\ufffd\ufffd4Q\ufffd\ufffd(\rS\u001bB\ufffdl\ufffd\/\ufffd \ufffdc(\ufffd\ufffd\u0019\u01f7W`z\u01fc\ufffd\u001cQF}\ufffd\u0011W\ufffd2\ufffdz\ufffd\ufffd\u001c%\ufffd\u026a\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d45194e90476fb17ff12a7e848b3aabd91419108", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffdq\ufffd\ufffd\n\u00115 \ufffd\r!H\u0018\ufffd\ufffd\ufffd\ufffd4Q\ufffd\ufffd(\rS\u001bB\ufffdl\ufffd\/\ufffd \ufffdc(\ufffd\ufffd\u0019\u01f7W`z\u01fc\ufffd\u001cQF}\ufffd\u0011W\ufffd2\ufffdz\ufffd\ufffd\u001c%\ufffd\u026a\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "725543c78edf669194c11dc7a039b56e", "port": 23456, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdq\ufffd\ufffd\n5 \ufffd\r!H\ufffd\ufffd\ufffd\ufffd4Q\ufffd\ufffd(\rSB\ufffdl\ufffd\/\ufffd \ufffdc(\ufffd\ufffd\u01f7W`z\u01fc\ufffdQF}\ufffdW\ufffd2\ufffdz\ufffd\ufffd%\ufffd\u026a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd", "attack_vector": "postgres probe \u00b7 via TLS:23456 \u00b7 (sonde \/ probe)", "target_port_label": "23456 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 57, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 23456, "protocol_emulated": null, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffdq\ufffd\ufffd\n\u00115 \ufffd\r!H\u0018\ufffd\ufffd\ufffd\ufffd4Q\ufffd\ufffd(\rS\u001bB\ufffdl\ufffd\/\ufffd \ufffdc(\ufffd\ufffd\u0019\u01f7W`z\u01fc\ufffd\u001cQF}\ufffd\u0011W\ufffd2\ufffdz\ufffd\ufffd\u001c%\ufffd\u026a\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "725543c78edf669194c11dc7a039b56e", "port": 23456, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "postgres probe \u00b7 via TLS:23456 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdq\ufffd\ufffd\n5 \ufffd\r!H\ufffd\ufffd\ufffd\ufffd4Q\ufffd\ufffd(\rSB\ufffdl\ufffd\/\ufffd \ufffdc(\ufffd\ufffd\u01f7W`z\u01fc\ufffdQF}\ufffdW\ufffd2\ufffdz\ufffd\ufffd%\ufffd\u026a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd", "target_port_label": "23456 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "23456" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni" ] }
14/07/2026 15:14:31 UTC	TCP	23456 · HTTP	http	SSRF ssrf attack · via HTTP:23456 · (tentative d'exploit)	Élevée	Moyen · 57
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-lab… Émulateur HTTP WAF 22 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 23456 Chemin / cible / Service HTTP Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 57 Confiance : Confiance 50 % — 4 tag(s) WAF Signaux Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Règles WAF rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: / Connection: close Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "2cce74947ae104861c6404693b60cc04c0330b1d", "http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 165, "payload_entropy": 5.222494310506847, "port_category": "registered", "org": "Internap Holding LLC", "service": "http", "app_proto": "http", "asn": 32475, "country": "US", "dst_port": 23456, "risk_waf": 96, "risk_classification": 84, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 96, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 57, "tag_count": 4, "anomaly_count": 0, "campaign_key": "8fe6512eb9ea1c5790902ce531e3da7093b61460", "event_fingerprint": "a88c5e6ca5c3fc810ce9277dd59e9d1df877da22", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "confidence": 0.5, "classification_confidence": 0.5, "precision_score": 55, "precision_signals": [ "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 96, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 57 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 32475, "org": "Internap Holding LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "83dce64baa2f0543cbc5015d0224fa45", "payload_hash": "25e1dbb9dc3e9dd092f07b00f8ffcace", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 23456, "service": "http", "service_name": "http", "risk_score": 57 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d6d2104cce17bd9632b1620175cf0884ad09a59e", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "port": 23456, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "attack_vector": "ssrf attack \u00b7 via HTTP:23456 \u00b7 (tentative d'exploit)", "target_port_label": "23456 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP", "confidence_pct": 50, "confidence_breakdown": { "waf": 96, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 57 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 57, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 23456, "protocol_emulated": null, "tags_summary": [ "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "port": 23456, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "ssrf attack \u00b7 via HTTP:23456 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "target_port_label": "23456 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "23456" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ] }
14/07/2026 14:57:17 UTC	TCP	8000 · SAP ICM	sap-icm	Sonde SAP ICM HTTP Sonde SAP ICM / WebDynpro · via SAP ICM:8000 · (sonde / probe)	Élevée	Faible · 34
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur SAP-ICM WAF — Recommandation Surveiller Tags http_get_probe mozi_pattern net_sap_web_probe sap_icm_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8000 Chemin / cible — Service SAP ICM Payload GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info Pourquoi cette classification : Type « sap_web_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 34 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: / Connection: close Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205341502049434d0d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2036300d0a0d0a3c68746d6c3e3c626f64793e53415020496e7465726e657420436f6d6d756e69636174696f6e204d616e616765723c", "emulator_response_len": 141, "bytes_in": 165, "payload_entropy": 5.222494310506847, "port_category": "registered", "org": "Internap Holding LLC", "service": "sap-icm", "app_proto": "sap-icm", "asn": 32475, "country": "US", "dst_port": 8000, "risk_waf": 8, "risk_classification": 54, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 48, "risk_novelty": 25, "risk_boost": 20, "risk_granularity": 2.1, "risk_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 0, "protocol": 48, "novelty": 25 }, "risk_score": 34, "tag_count": 5, "anomaly_count": 0, "campaign_key": "f4d3bfae803bd07fc62331c16ac15c5323341684", "event_fingerprint": "40ac2e001fc92fc4c26729171b1b914e26c42c6a", "classification_reason": "Type \u00ab sap_web_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 0, "protocol": 48, "novelty": 25, "risk_score": 34 }, "named_classification_skipped": false, "service_name": "sap-icm", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 32475, "org": "Internap Holding LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "25e1dbb9dc3e9dd092f07b00f8ffcace", "path_pattern_hash": "2dea5f3383fd8694e14eaf8b920fd9fc" }, "target_context": { "dst_port": 8000, "service": "sap-icm", "service_name": "sap-icm", "risk_score": 34 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "evidence": { "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "classification_reason": "Type \u00ab sap_web_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "sap_probe" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "7336a3c83f33a9c9e6cc00e5d3645d7c3d1fa5ad", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "port": 8000, "service": "sap-icm", "service_label_fr": "SAP ICM" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "attack_vector": "Sonde SAP ICM \/ WebDynpro \u00b7 via SAP ICM:8000 \u00b7 (sonde \/ probe)", "target_port_label": "8000 \u00b7 SAP ICM", "emulator_service": "sap-icm", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab sap_web_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab sap_web_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 0, "protocol": 48, "novelty": 25, "risk_score": 34 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 34, "risk_label": "Faible", "service_name": "sap-icm", "service_label_fr": "SAP ICM", "dst_port": 8000, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-sap-icm", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "port": 8000, "service": "sap-icm", "service_label_fr": "SAP ICM" }, "attack_vector": "Sonde SAP ICM \/ WebDynpro \u00b7 via SAP ICM:8000 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "target_port_label": "8000 \u00b7 SAP ICM", "emulator_service": "sap-icm", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "sap_icm", "service_banner": "honeypot-sap-icm", "service_os": "linux", "dst_port": "8000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "http_get_probe", "mozi_pattern", "net_sap_web_probe", "sap_icm_emulated", "sap_icm_payload" ] }
14/07/2026 14:57:17 UTC	TCP	8000 · SAP ICM	sap-icm	Sonde SAP ICM HTTP Sonde SAP ICM / WebDynpro · via SAP ICM:8000 · (sonde / probe)	Élevée	Faible · 34
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur SAP-ICM WAF — Recommandation Surveiller Tags http_get_probe mozi_pattern net_sap_web_probe sap_icm_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8000 Chemin / cible — Service SAP ICM Payload GET /favicon.ico HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/sc Pourquoi cette classification : Type « sap_web_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 34 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass User-Agent — Règles WAF — Payload (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/sc Requête brute (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: / Connection: close Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d547970653a20696d6167652f782d69636f6e0d0a436f6e74656e742d4c656e6774683a2032320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a0000010001001010000001002000680400001600", "emulator_response_len": 130, "bytes_in": 176, "payload_entropy": 5.2055424095882366, "port_category": "registered", "org": "Internap Holding LLC", "service": "sap-icm", "app_proto": "sap-icm", "asn": 32475, "country": "US", "dst_port": 8000, "risk_waf": 8, "risk_classification": 54, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 48, "risk_novelty": 25, "risk_boost": 20, "risk_granularity": 2.1, "risk_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 0, "protocol": 48, "novelty": 25 }, "risk_score": 34, "tag_count": 5, "anomaly_count": 0, "campaign_key": "f4d3bfae803bd07fc62331c16ac15c5323341684", "event_fingerprint": "40ac2e001fc92fc4c26729171b1b914e26c42c6a", "classification_reason": "Type \u00ab sap_web_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 0, "protocol": 48, "novelty": 25, "risk_score": 34 }, "named_classification_skipped": false, "service_name": "sap-icm", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 32475, "org": "Internap Holding LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d56ec1d099a290ccb29eb2acc5ada1e0", "path_pattern_hash": "2dea5f3383fd8694e14eaf8b920fd9fc" }, "target_context": { "dst_port": 8000, "service": "sap-icm", "service_name": "sap-icm", "risk_score": 34 }, "payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/sc", "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/sc", "evidence": { "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/sc", "classification_reason": "Type \u00ab sap_web_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "sap_probe" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "7f7886c2e6ac47b4d906df726a8a2ed8c264eb5d", "protocol_details": { "payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/sc", "port": 8000, "service": "sap-icm", "service_label_fr": "SAP ICM" }, "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/sc", "attack_vector": "Sonde SAP ICM \/ WebDynpro \u00b7 via SAP ICM:8000 \u00b7 (sonde \/ probe)", "target_port_label": "8000 \u00b7 SAP ICM", "emulator_service": "sap-icm", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab sap_web_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab sap_web_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 0, "protocol": 48, "novelty": 25, "risk_score": 34 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 34, "risk_label": "Faible", "service_name": "sap-icm", "service_label_fr": "SAP ICM", "dst_port": 8000, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-sap-icm", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/sc", "port": 8000, "service": "sap-icm", "service_label_fr": "SAP ICM" }, "attack_vector": "Sonde SAP ICM \/ WebDynpro \u00b7 via SAP ICM:8000 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/sc", "target_port_label": "8000 \u00b7 SAP ICM", "emulator_service": "sap-icm", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "sap_icm", "service_banner": "honeypot-sap-icm", "service_os": "linux", "dst_port": "8000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "http_get_probe", "mozi_pattern", "net_sap_web_probe", "sap_icm_emulated", "sap_icm_payload" ] }
14/07/2026 12:52:29 UTC	TCP	18888 · HTTP	http	SSRF ssrf attack · via HTTP:18888 · (tentative d'exploit)	Élevée	Moyen · 56
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-lab… Émulateur HTTP WAF 22 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 18888 Chemin / cible / Service HTTP Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 56 Confiance : Confiance 50 % — 4 tag(s) WAF Signaux Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Règles WAF rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: / Connection: close Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "2cce74947ae104861c6404693b60cc04c0330b1d", "http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 165, "payload_entropy": 5.222494310506847, "port_category": "registered", "org": "Internap Holding LLC", "service": "http", "app_proto": "http", "asn": 32475, "country": "US", "dst_port": 18888, "risk_waf": 96, "risk_classification": 84, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.8, "risk_breakdown": { "waf": 96, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 56, "tag_count": 4, "anomaly_count": 0, "campaign_key": "3d44cfdcd0cdefab89f5179bb3936b8fcb0df14a", "event_fingerprint": "191ac0ad8de9337365b0ef855b5014083bcfb60b", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "confidence": 0.5, "classification_confidence": 0.5, "precision_score": 55, "precision_signals": [ "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 96, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 56 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 32475, "org": "Internap Holding LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "83dce64baa2f0543cbc5015d0224fa45", "payload_hash": "25e1dbb9dc3e9dd092f07b00f8ffcace", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 18888, "service": "http", "service_name": "http", "risk_score": 56 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "957dc1a2bfbb235245af04375850c71be3fbd69e", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "port": 18888, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "attack_vector": "ssrf attack \u00b7 via HTTP:18888 \u00b7 (tentative d'exploit)", "target_port_label": "18888 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP", "confidence_pct": 50, "confidence_breakdown": { "waf": 96, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 56 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 56, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 18888, "protocol_emulated": null, "tags_summary": [ "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "port": 18888, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "ssrf attack \u00b7 via HTTP:18888 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "target_port_label": "18888 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "18888" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ] }
14/07/2026 12:52:29 UTC	TCP	18888 · TLS	tls	Sonde PostgreSQL postgres probe · via TLS:18888 · (sonde / probe)	Moyenne	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole JA3 725543c78edf6691 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 18888 Chemin / cible — Service TLS Payload ��pG��뗝�@�GmU�w�-�ϴk~ ��gD� o��s�$\��k��/P��x{i)��.� Gaǔ�+�/�,�0̨̩� �� c � Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 57% Corrélation +8 Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��pG��뗝�@�GmU�w�-�ϴk~ ��gD� o��s�$\��k��/P��x{i)��.� Gaǔ�+�/�,�0̨̩� �� c� Requête brute (extrait) ��pG��뗝�@�GmU�w�-�ϴk~ ��gD� o��s�$\��k��/P��x{i)��.� Gaǔ�+�/�,�0̨̩� �� c � �� 2+ 3����pW��)y#��_�d Meta JSON brut { "tls_ja3_hash": "725543c78edf669194c11dc7a039b56e", "tls_sni": null, "bytes_in": 1487, "payload_entropy": 7.715277652791095, "port_category": "registered", "org": "Internap Holding LLC", "service": "tls", "app_proto": "tls", "asn": 32475, "country": "US", "dst_port": 18888, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.1, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 2, "anomaly_count": 0, "campaign_key": "18deced0a5a4545a8fd6c1de8194470c31f93b70", "event_fingerprint": "f7284696ebbffd68961b9c0be42bc89087856bb4", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.57, "classification_confidence": 0.57, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 32475, "org": "Internap Holding LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "725543c78edf669194c11dc7a039b56e", "payload_hash": "7c56fcf6e17be8f822aeffdcaaf5d61a", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5" }, "target_context": { "dst_port": 18888, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003pG\ufffd\ufffd\ub5dd\u0019\ufffd@\ufffdGmU\ufffd\u001fw\ufffd-\ufffd\u03f4k~\n\ufffd\ufffd\ufffdgD\ufffd o\ufffd\ufffd\u001c\ufffd\ufffds\ufffd$\\\ufffd\ufffdk\ufffd\ufffd\/P\ufffd\ufffdx{i)\ufffd\ufffd.\ufffd\rGa\u01d4\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003pG\ufffd\ufffd\ub5dd\u0019\ufffd@\ufffdGmU\ufffd\u001fw\ufffd-\ufffd\u03f4k~\n\ufffd\ufffd\ufffdgD\ufffd o\ufffd\ufffd\u001c\ufffd\ufffds\ufffd$\\\ufffd\ufffdk\ufffd\ufffd\/P\ufffd\ufffdx{i)\ufffd\ufffd.\ufffd\rGa\u01d4\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\u0010\u0000\u000e\u0011\ufffd\u0011\ufffd\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd\u001a\u000f\ufffd\ufffd\ufffdpW\u0004\ufffd\ufffd)y#\ufffd\ufffd_\ufffd\u001ad", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003pG\ufffd\ufffd\ub5dd\u0019\ufffd@\ufffdGmU\ufffd\u001fw\ufffd-\ufffd\u03f4k~\n\ufffd\ufffd\ufffdgD\ufffd o\ufffd\ufffd\u001c\ufffd\ufffds\ufffd$\\\ufffd\ufffdk\ufffd\ufffd\/P\ufffd\ufffdx{i)\ufffd\ufffd.\ufffd\rGa\u01d4\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "47b141ac5e7df0d036dea3a2a0d7a07aefafe598", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003pG\ufffd\ufffd\ub5dd\u0019\ufffd@\ufffdGmU\ufffd\u001fw\ufffd-\ufffd\u03f4k~\n\ufffd\ufffd\ufffdgD\ufffd o\ufffd\ufffd\u001c\ufffd\ufffds\ufffd$\\\ufffd\ufffdk\ufffd\ufffd\/P\ufffd\ufffdx{i)\ufffd\ufffd.\ufffd\rGa\u01d4\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "725543c78edf669194c11dc7a039b56e", "port": 18888, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffdpG\ufffd\ufffd\ub5dd\ufffd@\ufffdGmU\ufffdw\ufffd-\ufffd\u03f4k~\n\ufffd\ufffd\ufffdgD\ufffd o\ufffd\ufffd\ufffd\ufffds\ufffd$\\\ufffd\ufffdk\ufffd\ufffd\/P\ufffd\ufffdx{i)\ufffd\ufffd.\ufffd\rGa\u01d4\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd", "attack_vector": "postgres probe \u00b7 via TLS:18888 \u00b7 (sonde \/ probe)", "target_port_label": "18888 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 57, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 18888, "protocol_emulated": null, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003pG\ufffd\ufffd\ub5dd\u0019\ufffd@\ufffdGmU\ufffd\u001fw\ufffd-\ufffd\u03f4k~\n\ufffd\ufffd\ufffdgD\ufffd o\ufffd\ufffd\u001c\ufffd\ufffds\ufffd$\\\ufffd\ufffdk\ufffd\ufffd\/P\ufffd\ufffdx{i)\ufffd\ufffd.\ufffd\rGa\u01d4\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "725543c78edf669194c11dc7a039b56e", "port": 18888, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "postgres probe \u00b7 via TLS:18888 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffdpG\ufffd\ufffd\ub5dd\ufffd@\ufffdGmU\ufffdw\ufffd-\ufffd\u03f4k~\n\ufffd\ufffd\ufffdgD\ufffd o\ufffd\ufffd\ufffd\ufffds\ufffd$\\\ufffd\ufffdk\ufffd\ufffd\/P\ufffd\ufffdx{i)\ufffd\ufffd.\ufffd\rGa\u01d4\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd", "target_port_label": "18888 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "18888" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni" ], "behavior_alert_count": 1, "behavior_priority": 72 }
14/07/2026 11:53:54 UTC	TCP	3 · TLS	tls	Sonde PostgreSQL postgres probe · via TLS:3 · (sonde / probe)	Moyenne	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole JA3 725543c78edf6691 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3 Chemin / cible — Service TLS Payload ��&��m�UXK��0�Y �X�HC�U��>� �R��D�CPU��ueu��8;�'�AM�l_k�+�/�,�0̨̩� �� c � Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 57% Corrélation +8 Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��&��m�UXK��0�Y �X�HC�U��>� �R��D�CPU��ueu��8;�'�AM�l_k�+�/�,�0̨̩� �� c� Requête brute (extrait) ��&��m�UXK��0�Y �X�HC�U��>� �R��D�CPU��ueu��8;�'�AM�l_k�+�/�,�0̨̩� �� c � �� 2+ 3��@aO��:��pzSl��Ȟ�� Meta JSON brut { "tls_ja3_hash": "725543c78edf669194c11dc7a039b56e", "tls_sni": null, "bytes_in": 1487, "payload_entropy": 7.716740303245524, "port_category": "well_known", "org": "Internap Holding LLC", "service": "tls", "app_proto": "tls", "asn": 32475, "country": "US", "dst_port": 3, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.2, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 2, "anomaly_count": 0, "campaign_key": "eab630f851eca15aca5f7f357956389337fba0c1", "event_fingerprint": "de234cb86e7037698cac555db325d8e88e7016c6", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.57, "classification_confidence": 0.57, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 32475, "org": "Internap Holding LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "725543c78edf669194c11dc7a039b56e", "payload_hash": "5cd89f839d7ca28f23c4ea571c203f5d", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5" }, "target_context": { "dst_port": 3, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd&\ufffd\ufffd\ufffdm\ufffdUXK\ufffd\ufffd0\u0018\u0018\ufffdY \ufffdX\ufffdHC\ufffdU\ufffd\u001e\ufffd>\u0017\ufffd \ufffdR\ufffd\ufffdD\u0003\ufffdCPU\ufffd\ufffdueu\ufffd\ufffd\ufffd8;\ufffd'\u0019\ufffd\u0013A\u0003M\ufffdl_k\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd&\ufffd\ufffd\ufffdm\ufffdUXK\ufffd\ufffd0\u0018\u0018\ufffdY \ufffdX\ufffdHC\ufffdU\ufffd\u001e\ufffd>\u0017\ufffd \ufffdR\ufffd\ufffdD\u0003\ufffdCPU\ufffd\ufffdueu\ufffd\ufffd\ufffd8;\ufffd'\u0019\ufffd\u0013A\u0003M\ufffdl_k\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\u0010\u0000\u000e\u0011\ufffd\u0011\ufffd\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd@a\u001dO\ufffd\u0003\ufffd:\ufffd\ufffdpzSl\ufffd\ufffd\ufffd\u021e\ufffd\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd&\ufffd\ufffd\ufffdm\ufffdUXK\ufffd\ufffd0\u0018\u0018\ufffdY \ufffdX\ufffdHC\ufffdU\ufffd\u001e\ufffd>\u0017\ufffd \ufffdR\ufffd\ufffdD\u0003\ufffdCPU\ufffd\ufffdueu\ufffd\ufffd\ufffd8;\ufffd'\u0019\ufffd\u0013A\u0003M\ufffdl_k\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "87e6b58d05f69dd9b27c32de0a8448679810b4f6", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd&\ufffd\ufffd\ufffdm\ufffdUXK\ufffd\ufffd0\u0018\u0018\ufffdY \ufffdX\ufffdHC\ufffdU\ufffd\u001e\ufffd>\u0017\ufffd \ufffdR\ufffd\ufffdD\u0003\ufffdCPU\ufffd\ufffdueu\ufffd\ufffd\ufffd8;\ufffd'\u0019\ufffd\u0013A\u0003M\ufffdl_k\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "725543c78edf669194c11dc7a039b56e", "port": 3, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd&\ufffd\ufffd\ufffdm\ufffdUXK\ufffd\ufffd0\ufffdY \ufffdX\ufffdHC\ufffdU\ufffd\ufffd>\ufffd \ufffdR\ufffd\ufffdD\ufffdCPU\ufffd\ufffdueu\ufffd\ufffd\ufffd8;\ufffd'\ufffdAM\ufffdl_k\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd", "attack_vector": "postgres probe \u00b7 via TLS:3 \u00b7 (sonde \/ probe)", "target_port_label": "3 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 57, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 3, "protocol_emulated": null, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd&\ufffd\ufffd\ufffdm\ufffdUXK\ufffd\ufffd0\u0018\u0018\ufffdY \ufffdX\ufffdHC\ufffdU\ufffd\u001e\ufffd>\u0017\ufffd \ufffdR\ufffd\ufffdD\u0003\ufffdCPU\ufffd\ufffdueu\ufffd\ufffd\ufffd8;\ufffd'\u0019\ufffd\u0013A\u0003M\ufffdl_k\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "725543c78edf669194c11dc7a039b56e", "port": 3, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "postgres probe \u00b7 via TLS:3 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd&\ufffd\ufffd\ufffdm\ufffdUXK\ufffd\ufffd0\ufffdY \ufffdX\ufffdHC\ufffdU\ufffd\ufffd>\ufffd \ufffdR\ufffd\ufffdD\ufffdCPU\ufffd\ufffdueu\ufffd\ufffd\ufffd8;\ufffd'\ufffdAM\ufffdl_k\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd", "target_port_label": "3 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "3" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni" ] }
14/07/2026 11:53:53 UTC	TCP	3 · HTTP	http	SSRF ssrf attack · via HTTP:3 · (tentative d'exploit)	Élevée	Moyen · 55
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-lab… Émulateur HTTP WAF 22 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 3 Chemin / cible / Service HTTP Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 55 Confiance : Confiance 50 % — 4 tag(s) WAF Signaux Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Règles WAF rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: / Connection: close Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "2cce74947ae104861c6404693b60cc04c0330b1d", "http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 165, "payload_entropy": 5.222494310506847, "port_category": "well_known", "org": "Internap Holding LLC", "service": "http", "app_proto": "http", "asn": 32475, "country": "US", "dst_port": 3, "risk_waf": 96, "risk_classification": 84, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.9, "risk_breakdown": { "waf": 96, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 55, "tag_count": 4, "anomaly_count": 0, "campaign_key": "d3cc1025a9b9a498d5f50e307f8c15c1e0ee2a8a", "event_fingerprint": "c9ae2709fef14b568d81e402a9330e925f530314", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "confidence": 0.5, "classification_confidence": 0.5, "precision_score": 55, "precision_signals": [ "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 96, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 55 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 32475, "org": "Internap Holding LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "83dce64baa2f0543cbc5015d0224fa45", "payload_hash": "25e1dbb9dc3e9dd092f07b00f8ffcace", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 3, "service": "http", "service_name": "http", "risk_score": 55 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0a2f402bc9397641d7b4d0570879ceb136b31f1f", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "port": 3, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "attack_vector": "ssrf attack \u00b7 via HTTP:3 \u00b7 (tentative d'exploit)", "target_port_label": "3 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP", "confidence_pct": 50, "confidence_breakdown": { "waf": 96, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 55 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 55, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3, "protocol_emulated": null, "tags_summary": [ "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)", "port": 3, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "ssrf attack \u00b7 via HTTP:3 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "target_port_label": "3 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ] }
14/07/2026 10:39:29 UTC	TCP	13 · DAYTIME	daytime	Botnet Mozi mozi pattern · via DAYTIME:13 · (commande & contrôle)	Élevée	Faible · 36
Étape Commande & contrôle Chaîne Commande & contrôle Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0011 TA0011 Protocole Émulateur DAYTIME WAF — Recommandation Surveiller Tags http_get_probe mozi_pattern net_mozi_pattern Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 13 Chemin / cible — Service DAYTIME Payload GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info Pourquoi cette classification : Type « mozi_pattern » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 36 Confiance : Confiance 0 % — 3 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0011 Tactiques MITRE TA0011 Motifs de détection (base) LFI Double-dot bypass User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: / Connection: close Meta JSON brut { "protocol_emulated": true, "emulator_response": "546875204a756e2020342031323a30303a303020323032360d0a", "emulator_response_len": 26, "bytes_in": 165, "payload_entropy": 5.222494310506847, "port_category": "well_known", "org": "Internap Holding LLC", "service": "daytime", "app_proto": "daytime", "asn": 32475, "country": "US", "dst_port": 13, "risk_waf": 8, "risk_classification": 82, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 15, "risk_boost": 20, "risk_granularity": 3.1, "risk_breakdown": { "waf": 8, "classification": 82, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 15 }, "risk_score": 36, "tag_count": 3, "anomaly_count": 0, "campaign_key": "8b81552b64eb438d8100a262cabb42682f3c99a5", "event_fingerprint": "5cb6f1d0b2a41cc9ad660eed6f01dbbd01638ddd", "classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 8, "classification": 82, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 15, "risk_score": 36 }, "named_classification_skipped": false, "service_name": "daytime", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 32475, "org": "Internap Holding LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "25e1dbb9dc3e9dd092f07b00f8ffcace", "path_pattern_hash": "762d384fab941f6d0c2239f19994f30e" }, "target_context": { "dst_port": 13, "service": "daytime", "service_name": "daytime", "risk_score": 36 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "evidence": { "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: \/\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "c2", "mitre_tactics": [ "TA0011" ], "mitre": "TA0011", "threat_family": [ "botnet" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "87880c92ff48b6b6a53fab2a1ea0ed71de135a03", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "port": 13, "service": "daytime", "service_label_fr": "DAYTIME" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "attack_vector": "mozi pattern \u00b7 via DAYTIME:13 \u00b7 (commande & contr\u00f4le)", "target_port_label": "13 \u00b7 DAYTIME", "emulator_service": "daytime", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 36\/100 (Faible) \u2014 MITRE TA0011 \u2014 via DAYTIME", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 82, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 15, "risk_score": 36 }, "attack_stage": "c2", "attack_stage_label": "Commande & contr\u00f4le", "attack_chain_stage": "command_and_control", "attack_chain_stage_label_fr": "Commande & contr\u00f4le", "risk_score": 36, "risk_label": "Faible", "service_name": "daytime", "service_label_fr": "DAYTIME", "dst_port": 13, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0011", "mitre_technique": "TA0011", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-daytime", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "port": 13, "service": "daytime", "service_label_fr": "DAYTIME" }, "attack_vector": "mozi pattern \u00b7 via DAYTIME:13 \u00b7 (commande & contr\u00f4le)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info", "target_port_label": "13 \u00b7 DAYTIME", "emulator_service": "daytime", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": true, "kind": "stage" }, { "key": "command_and_control", "label_fr": "Commande & contr\u00f4le", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "daytime", "service_banner": "honeypot-daytime", "service_os": "linux", "dst_port": "13" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "command_and_control", "ban_policy": "advisory_monitor", "tags_list": [ "http_get_probe", "mozi_pattern", "net_mozi_pattern" ] }

162.217.100.41

Pourquoi listée

Comparaison ASN / FAI

IPs apparentées

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence