14/06/2026 19:01:06 UTC
TCP
1273 · HTTP
Sonde HTTP
Sonde HTTP · via HTTP:1273 · (sonde / probe) · → /robots.txt
Moyenne
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1595
TA0007
TA0001
Protocole
GET /robots.txt UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/robots.txt
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
1273
Chemin / cible
/robots.txt
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 40
Confiance : Confiance 95 % — Motif catalogue confirmé
Signaux
Requête robots.txt
Single Port
Chemin bénin connu
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /robots.txt HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /robots.txt HTTP/1.1
Host: 62.3.50.33:1273
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "txt",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "9b97e275f2854286178e6ab1b8f0075338c97a1b",
"http_target_hash": "b7a9adb9fec4116c29da690c45d9a67df535af9d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 125,
"payload_entropy": 4.900438313567961,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "US",
"dst_port": 1273,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 0.7,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "63c3372f51994b848c44c582d3e4d85b6e49cd91",
"event_fingerprint": "836fdff0c1d6b9391e3dbe651749ef741d3e5465",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 94,
"precision_signals": [
"INT-benign-robots",
"INT-single-port",
"INT-benign-path-cap"
],
"kb_rule_ids": [
"INT-benign-robots",
"INT-single-port",
"INT-benign-path-cap"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "74341d1aed7d7f3bddaec8382d90a665",
"path_pattern_hash": "adada1317532a28bebf63fe6edbea3e4"
},
"target_context": {
"dst_port": 1273,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:1273\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:1273\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:1273\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:1273\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:1273\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5ebe19aa5fd201710b312a10f250c9e14d1e7940",
"protocol_details": {
"http_method": "GET",
"http_path": "\/robots.txt",
"request_line": "GET \/robots.txt HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 1273,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:1273\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:1273 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/robots.txt",
"target_port_label": "1273 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 1273,
"protocol_emulated": null,
"tags_summary": [
"INT-benign-robots",
"INT-single-port",
"INT-benign-path-cap"
],
"tags_summary_labels_fr": [
"Requ\u00eate robots.txt",
"Single Port",
"Chemin b\u00e9nin connu"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/robots.txt",
"request_line": "GET \/robots.txt HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 1273,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:1273 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/robots.txt",
"evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:1273\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"target_port_label": "1273 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "1273"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
14/06/2026 19:01:05 UTC
TCP
1273 · HTTP
Tentative d'exploit
exploit attempt · via HTTP:1273 · (tentative d'exploit)
Élevée
Moyen · 43
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Windows NT 9_1_2; Win64; x64) AppleWebKit/580.44 (…
Émulateur
HTTP
WAF
16
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
1273
Chemin / cible
/
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
62%
Risque capteur
Moyen
· 43
Confiance : Confiance 62 % — 3 tag(s) WAF
Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 9_1_2; Win64; x64) AppleWebKit/580.44 (KHTML, like Gecko) Chrome/82.0.2562 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:1273
User-Agent: Mozilla/5.0 (Windows NT 9_1_2; Win64; x64) AppleWebKit/580.44 (KHTML, like Ge
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:1273 User-Agent: Mozilla/5.0 (Windows NT 9_1_2; Win64; x64) AppleWebKit/580.44 (KHTML, like Gecko) Chrome/82.0.2562 Safari/537.36 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "d5febf7ce657483d4687c4bd85df29dae96989bf",
"http_host_hash": "9b97e275f2854286178e6ab1b8f0075338c97a1b",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 209,
"payload_entropy": 5.4416177819630125,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "US",
"dst_port": 1273,
"risk_waf": 72,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 43,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "bab9839e504461fee4e7ee4e3ad9d62df702e6a9",
"event_fingerprint": "958e3555d10a13098b0dbe0f0500213091f1ec12",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence": 0.62,
"classification_confidence": 0.62,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"confidence_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 43
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "7e5a3ce84f0707d40b7db3be62d08b70",
"payload_hash": "c6f6e57ff6a3fad4583a7ba4c10e9852",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 1273,
"service": "http",
"service_name": "http",
"risk_score": 43
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1273\r\nUser-Agent: Mozilla\/5.0 (Windows NT 9_1_2; Win64; x64) AppleWebKit\/580.44 (KHTML, like Ge",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 9_1_2; Win64; x64) AppleWebKit\/580.44 (KHTML, like Gecko) Chrome\/82.0.2562 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1273\r\nUser-Agent: Mozilla\/5.0 (Windows NT 9_1_2; Win64; x64) AppleWebKit\/580.44 (KHTML, like Gecko) Chrome\/82.0.2562 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1273\r\nUser-Agent: Mozilla\/5.0 (Windows NT 9_1_2; Win64; x64) AppleWebKit\/580.44 (KHTML, like Ge",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 9_1_2; Win64; x64) AppleWebKit\/580.44 (KHTML, like Gecko) Chrome\/82.0.2562 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1273\r\nUser-Agent: Mozilla\/5.0 (Windows NT 9_1_2; Win64; x64) AppleWebKit\/580.44 (KHTML, like Gecko) Chrome\/82.0.2562 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1273\r\nUser-Agent: Mozilla\/5.0 (Windows NT 9_1_2; Win64; x64) AppleWebKit\/580.44 (KHTML, like Ge",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9ad15e5770de2e6f6e7144cdf3c16955af53a3f9",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 9_1_2; Win64; x64) AppleWebKit\/580.44 (KHTML, like Gecko) Chrome\/82.0.2562 Safari\/537.36",
"port": 1273,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1273\r\nUser-Agent: Mozilla\/5.0 (Windows NT 9_1_2; Win64; x64) AppleWebKit\/580.44 (KHTML, like Ge",
"attack_vector": "exploit attempt \u00b7 via HTTP:1273 \u00b7 (tentative d'exploit)",
"target_port_label": "1273 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP",
"confidence_pct": 62,
"confidence_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 43
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 1273,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1190"
],
"tags_summary_labels_fr": [
"MITRE-T1190"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 9_1_2; Win64; x64) AppleWebKit\/580.44 (KHTML, like Gecko) Chrome\/82.0.2562 Safari\/537.36",
"port": 1273,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "exploit attempt \u00b7 via HTTP:1273 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1273\r\nUser-Agent: Mozilla\/5.0 (Windows NT 9_1_2; Win64; x64) AppleWebKit\/580.44 (KHTML, like Ge",
"target_port_label": "1273 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "1273"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
]
}
08/06/2026 15:34:44 UTC
TCP
8801 · HTTP
Sonde HTTP
Sonde HTTP · via HTTP:8801 · (sonde / probe) · → /favicon.ico
Moyenne
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1595
TA0007
TA0001
Protocole
GET /favicon.ico UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/favicon.ico
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8801
Chemin / cible
/favicon.ico
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 40
Confiance : Confiance 95 % — Motif catalogue confirmé
Signaux
Requête favicon.ico
Single Port
Chemin bénin connu
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /favicon.ico HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /favicon.ico HTTP/1.1
Host: 62.3.50.33:8801
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "ico",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "f552f2f9e44afa4429768cd28a4f061e01f13f89",
"http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 126,
"payload_entropy": 4.926020078720399,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "US",
"dst_port": 8801,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.8,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "6e9bc15b9863e1cdf448e03d2478a4315e37460b",
"event_fingerprint": "275f8b3b2dbe37b7ccdefa8f26b0beda968f4e70",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 94,
"precision_signals": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"kb_rule_ids": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "b124f53402226f442b5fa8ebcbeb98c9",
"path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a"
},
"target_context": {
"dst_port": 8801,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:8801\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/favicon.ico",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:8801\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:8801\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/favicon.ico",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:8801\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:8801\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "49441aa6e00e1b86fed2a9b093876ded414da83e",
"protocol_details": {
"http_method": "GET",
"http_path": "\/favicon.ico",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8801,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:8801\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8801 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
"target_port_label": "8801 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8801,
"protocol_emulated": null,
"tags_summary": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"tags_summary_labels_fr": [
"Requ\u00eate favicon.ico",
"Single Port",
"Chemin b\u00e9nin connu"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/favicon.ico",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8801,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8801 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
"evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:8801\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"target_port_label": "8801 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8801"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
08/06/2026 15:34:44 UTC
TCP
8801 · HTTP
Sonde HTTP
Sonde HTTP · via HTTP:8801 · (sonde / probe) · → /robots.txt
Moyenne
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1595
TA0007
TA0001
Protocole
GET /robots.txt UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/robots.txt
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8801
Chemin / cible
/robots.txt
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 40
Confiance : Confiance 95 % — Motif catalogue confirmé
Signaux
Requête robots.txt
Single Port
Chemin bénin connu
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /robots.txt HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /robots.txt HTTP/1.1
Host: 62.3.50.33:8801
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "txt",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "f552f2f9e44afa4429768cd28a4f061e01f13f89",
"http_target_hash": "b7a9adb9fec4116c29da690c45d9a67df535af9d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 125,
"payload_entropy": 4.910399213550653,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "US",
"dst_port": 8801,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.8,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "6e9bc15b9863e1cdf448e03d2478a4315e37460b",
"event_fingerprint": "1f46770010f7e3e7118ba156aef0fc611c4a6e11",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 94,
"precision_signals": [
"INT-benign-robots",
"INT-single-port",
"INT-benign-path-cap"
],
"kb_rule_ids": [
"INT-benign-robots",
"INT-single-port",
"INT-benign-path-cap"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "623002274067c4b5ccb8bf4193b797ff",
"path_pattern_hash": "adada1317532a28bebf63fe6edbea3e4"
},
"target_context": {
"dst_port": 8801,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:8801\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:8801\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:8801\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:8801\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:8801\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "71cd081b861774fddf3a2eed71948ae189f00f5e",
"protocol_details": {
"http_method": "GET",
"http_path": "\/robots.txt",
"request_line": "GET \/robots.txt HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8801,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:8801\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8801 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/robots.txt",
"target_port_label": "8801 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8801,
"protocol_emulated": null,
"tags_summary": [
"INT-benign-robots",
"INT-single-port",
"INT-benign-path-cap"
],
"tags_summary_labels_fr": [
"Requ\u00eate robots.txt",
"Single Port",
"Chemin b\u00e9nin connu"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/robots.txt",
"request_line": "GET \/robots.txt HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8801,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8801 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/robots.txt",
"evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:8801\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"target_port_label": "8801 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8801"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
08/06/2026 15:34:44 UTC
TCP
8801 · HTTP
Sonde HTTP
Sonde HTTP · via HTTP:8801 · (sonde / probe) · → /sitemap.xml
Moyenne
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1595
TA0007
TA0001
Protocole
GET /sitemap.xml UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/sitemap.xml
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8801
Chemin / cible
/sitemap.xml
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 40
Confiance : Confiance 95 % — Motif catalogue confirmé
Signaux
Requête sitemap.xml
Single Port
Chemin bénin connu
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /sitemap.xml HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /sitemap.xml HTTP/1.1
Host: 62.3.50.33:8801
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "xml",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "f552f2f9e44afa4429768cd28a4f061e01f13f89",
"http_target_hash": "aefeebe85207f9638bc792aa32d2470b82e35120",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 126,
"payload_entropy": 4.969621368984871,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "US",
"dst_port": 8801,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.8,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "6e9bc15b9863e1cdf448e03d2478a4315e37460b",
"event_fingerprint": "1dfd457de6d565e22a55a694ec16f497fddd703c",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 92,
"precision_signals": [
"INT-benign-sitemap",
"INT-single-port",
"INT-benign-path-cap"
],
"kb_rule_ids": [
"INT-benign-sitemap",
"INT-single-port",
"INT-benign-path-cap"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "8e408557ab26fb1c4bf3bf5dda25cddb",
"path_pattern_hash": "7efd2a819481844ebcfd47a818831daf"
},
"target_context": {
"dst_port": 8801,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:8801\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/sitemap.xml",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:8801\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:8801\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/sitemap.xml",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:8801\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:8801\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "685da7b8c3ca392f41f7d0d38ac7fbc65e68a9a6",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sitemap.xml",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8801,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:8801\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8801 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
"target_port_label": "8801 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8801,
"protocol_emulated": null,
"tags_summary": [
"INT-benign-sitemap",
"INT-single-port",
"INT-benign-path-cap"
],
"tags_summary_labels_fr": [
"Requ\u00eate sitemap.xml",
"Single Port",
"Chemin b\u00e9nin connu"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/sitemap.xml",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8801,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8801 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
"evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:8801\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"target_port_label": "8801 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8801"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
08/06/2026 15:34:43 UTC
TCP
8801 · HTTP
Tentative d'exploit
exploit attempt · via HTTP:8801 · (tentative d'exploit)
Élevée
Moyen · 48
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/601.38 (KHTML, like…
Émulateur
HTTP
WAF
16
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8801
Chemin / cible
/
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
62%
Risque capteur
Moyen
· 48
Confiance : Confiance 62 % — 3 tag(s) WAF
Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/601.38 (KHTML, like Gecko) Chrome/55.0.1899 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:8801
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/601.38 (KHTML, like Gecko) Chrome
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:8801 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/601.38 (KHTML, like Gecko) Chrome/55.0.1899 Safari/537.36 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "f63ec35335b2c57f672d3d364abad622823a7a0b",
"http_host_hash": "f552f2f9e44afa4429768cd28a4f061e01f13f89",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 198,
"payload_entropy": 5.422282796036874,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "US",
"dst_port": 8801,
"risk_waf": 72,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.5,
"risk_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 48,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "290287c29513a2bc57ad8c9c1ec0a84cf646727e",
"event_fingerprint": "a5a1448ac1bd753e4938e40948bd1f756787ccc8",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence": 0.62,
"classification_confidence": 0.62,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"confidence_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 48
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "11a028c019c64eb3f7e130cadcf499d1",
"payload_hash": "9b8bd9c13f505b8021864297f3e258c7",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8801,
"service": "http",
"service_name": "http",
"risk_score": 48
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8801\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/601.38 (KHTML, like Gecko) Chrome",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/601.38 (KHTML, like Gecko) Chrome\/55.0.1899 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8801\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/601.38 (KHTML, like Gecko) Chrome\/55.0.1899 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8801\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/601.38 (KHTML, like Gecko) Chrome",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/601.38 (KHTML, like Gecko) Chrome\/55.0.1899 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8801\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/601.38 (KHTML, like Gecko) Chrome\/55.0.1899 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8801\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/601.38 (KHTML, like Gecko) Chrome",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7044436bb2a787c2777198b94de2a5a3aea31c11",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/601.38 (KHTML, like Gecko) Chrome\/55.0.1899 Safari\/537.36",
"port": 8801,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8801\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/601.38 (KHTML, like Gecko) Chrome",
"attack_vector": "exploit attempt \u00b7 via HTTP:8801 \u00b7 (tentative d'exploit)",
"target_port_label": "8801 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 48\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP",
"confidence_pct": 62,
"confidence_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 48
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 48,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8801,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1190"
],
"tags_summary_labels_fr": [
"MITRE-T1190"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/601.38 (KHTML, like Gecko) Chrome\/55.0.1899 Safari\/537.36",
"port": 8801,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "exploit attempt \u00b7 via HTTP:8801 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8801\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/601.38 (KHTML, like Gecko) Chrome",
"target_port_label": "8801 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8801"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"behavior_alert_count": 1,
"behavior_priority": 96
}
08/06/2026 15:31:18 UTC
TCP
5200 · HTTP
Sonde HTTP
Sonde HTTP · via HTTP:5200 · (sonde / probe) · → /sitemap.xml
Moyenne
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1595
TA0007
TA0001
Protocole
GET /sitemap.xml UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/sitemap.xml
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
5200
Chemin / cible
/sitemap.xml
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 40
Confiance : Confiance 95 % — Motif catalogue confirmé
Signaux
Requête sitemap.xml
Single Port
Chemin bénin connu
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /sitemap.xml HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /sitemap.xml HTTP/1.1
Host: 62.3.50.33:5200
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "xml",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "dcb8e77c9218e9a917610813114a840c24f7110b",
"http_target_hash": "aefeebe85207f9638bc792aa32d2470b82e35120",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 126,
"payload_entropy": 4.9605321068600565,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "US",
"dst_port": 5200,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "6ecf3b672e89fb60e45e924322318018e60e4beb",
"event_fingerprint": "31cc52d27e323b2be04ed600e6ec1e174c346293",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 92,
"precision_signals": [
"INT-benign-sitemap",
"INT-single-port",
"INT-benign-path-cap"
],
"kb_rule_ids": [
"INT-benign-sitemap",
"INT-single-port",
"INT-benign-path-cap"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "8128a9ede42b5ed11b6dabb12d8cc93a",
"path_pattern_hash": "7efd2a819481844ebcfd47a818831daf"
},
"target_context": {
"dst_port": 5200,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:5200\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/sitemap.xml",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:5200\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:5200\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/sitemap.xml",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:5200\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:5200\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "54a1a04d5b1fe0b5def491ff0e05a401d511ae51",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sitemap.xml",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 5200,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:5200\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:5200 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
"target_port_label": "5200 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5200,
"protocol_emulated": null,
"tags_summary": [
"INT-benign-sitemap",
"INT-single-port",
"INT-benign-path-cap"
],
"tags_summary_labels_fr": [
"Requ\u00eate sitemap.xml",
"Single Port",
"Chemin b\u00e9nin connu"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/sitemap.xml",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 5200,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:5200 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
"evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:5200\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"target_port_label": "5200 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5200"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
08/06/2026 15:31:18 UTC
TCP
5200 · HTTP
Sonde HTTP
Sonde HTTP · via HTTP:5200 · (sonde / probe) · → /robots.txt
Moyenne
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1595
TA0007
TA0001
Protocole
GET /robots.txt UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/robots.txt
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
5200
Chemin / cible
/robots.txt
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 40
Confiance : Confiance 95 % — Motif catalogue confirmé
Signaux
Requête robots.txt
Single Port
Chemin bénin connu
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /robots.txt HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /robots.txt HTTP/1.1
Host: 62.3.50.33:5200
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "txt",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "dcb8e77c9218e9a917610813114a840c24f7110b",
"http_target_hash": "b7a9adb9fec4116c29da690c45d9a67df535af9d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 125,
"payload_entropy": 4.901237237328839,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "US",
"dst_port": 5200,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "6ecf3b672e89fb60e45e924322318018e60e4beb",
"event_fingerprint": "41f5d153edfdaee0f49ba54c6d9d8c2048154f96",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 94,
"precision_signals": [
"INT-benign-robots",
"INT-single-port",
"INT-benign-path-cap"
],
"kb_rule_ids": [
"INT-benign-robots",
"INT-single-port",
"INT-benign-path-cap"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "8f0d086cc20240e6565e3d8596a7b99f",
"path_pattern_hash": "adada1317532a28bebf63fe6edbea3e4"
},
"target_context": {
"dst_port": 5200,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:5200\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:5200\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:5200\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:5200\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:5200\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "852a85efeded4ba2b00c73976c1045e5ce036fb6",
"protocol_details": {
"http_method": "GET",
"http_path": "\/robots.txt",
"request_line": "GET \/robots.txt HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 5200,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:5200\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:5200 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/robots.txt",
"target_port_label": "5200 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5200,
"protocol_emulated": null,
"tags_summary": [
"INT-benign-robots",
"INT-single-port",
"INT-benign-path-cap"
],
"tags_summary_labels_fr": [
"Requ\u00eate robots.txt",
"Single Port",
"Chemin b\u00e9nin connu"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/robots.txt",
"request_line": "GET \/robots.txt HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 5200,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:5200 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/robots.txt",
"evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:5200\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"target_port_label": "5200 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5200"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
08/06/2026 15:31:17 UTC
TCP
5200 · HTTP
Tentative d'exploit
exploit attempt · via HTTP:5200 · (tentative d'exploit)
Élevée
Moyen · 47
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Windows NT 9_2_2; Win64; x64) AppleWebKit/549.41 (…
Émulateur
HTTP
WAF
16
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
5200
Chemin / cible
/
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
62%
Risque capteur
Moyen
· 47
Confiance : Confiance 62 % — 3 tag(s) WAF
Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 9_2_2; Win64; x64) AppleWebKit/549.41 (KHTML, like Gecko) Chrome/92.0.633 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:5200
User-Agent: Mozilla/5.0 (Windows NT 9_2_2; Win64; x64) AppleWebKit/549.41 (KHTML, like Ge
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:5200 User-Agent: Mozilla/5.0 (Windows NT 9_2_2; Win64; x64) AppleWebKit/549.41 (KHTML, like Gecko) Chrome/92.0.633 Safari/537.36 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "016e1bd16ada0a9eb3d6d037315b7ecb79ec20d1",
"http_host_hash": "dcb8e77c9218e9a917610813114a840c24f7110b",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 208,
"payload_entropy": 5.417262157691163,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "US",
"dst_port": 5200,
"risk_waf": 72,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 47,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "ad4b4e15400944ea229a728b1b3174d659675ed9",
"event_fingerprint": "e25ceeac8ff8e9fd58339038dc8e422faaea313d",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence": 0.62,
"classification_confidence": 0.62,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"confidence_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 47
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "51898c6eccc396cdeb5f6f5f7cf7082b",
"payload_hash": "8d6140de9391e9b539abb118066717a0",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 5200,
"service": "http",
"service_name": "http",
"risk_score": 47
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5200\r\nUser-Agent: Mozilla\/5.0 (Windows NT 9_2_2; Win64; x64) AppleWebKit\/549.41 (KHTML, like Ge",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 9_2_2; Win64; x64) AppleWebKit\/549.41 (KHTML, like Gecko) Chrome\/92.0.633 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5200\r\nUser-Agent: Mozilla\/5.0 (Windows NT 9_2_2; Win64; x64) AppleWebKit\/549.41 (KHTML, like Gecko) Chrome\/92.0.633 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5200\r\nUser-Agent: Mozilla\/5.0 (Windows NT 9_2_2; Win64; x64) AppleWebKit\/549.41 (KHTML, like Ge",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 9_2_2; Win64; x64) AppleWebKit\/549.41 (KHTML, like Gecko) Chrome\/92.0.633 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5200\r\nUser-Agent: Mozilla\/5.0 (Windows NT 9_2_2; Win64; x64) AppleWebKit\/549.41 (KHTML, like Gecko) Chrome\/92.0.633 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5200\r\nUser-Agent: Mozilla\/5.0 (Windows NT 9_2_2; Win64; x64) AppleWebKit\/549.41 (KHTML, like Ge",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7e1409d3fceccc0f475304ade68cf1bea02b21c3",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 9_2_2; Win64; x64) AppleWebKit\/549.41 (KHTML, like Gecko) Chrome\/92.0.633 Safari\/537.36",
"port": 5200,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5200\r\nUser-Agent: Mozilla\/5.0 (Windows NT 9_2_2; Win64; x64) AppleWebKit\/549.41 (KHTML, like Ge",
"attack_vector": "exploit attempt \u00b7 via HTTP:5200 \u00b7 (tentative d'exploit)",
"target_port_label": "5200 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP",
"confidence_pct": 62,
"confidence_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 47
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 47,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5200,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1190"
],
"tags_summary_labels_fr": [
"MITRE-T1190"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 9_2_2; Win64; x64) AppleWebKit\/549.41 (KHTML, like Gecko) Chrome\/92.0.633 Safari\/537.36",
"port": 5200,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "exploit attempt \u00b7 via HTTP:5200 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5200\r\nUser-Agent: Mozilla\/5.0 (Windows NT 9_2_2; Win64; x64) AppleWebKit\/549.41 (KHTML, like Ge",
"target_port_label": "5200 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5200"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
]
}
08/06/2026 15:31:17 UTC
TCP
5200 · HTTP
Sonde HTTP
Sonde HTTP · via HTTP:5200 · (sonde / probe) · → /favicon.ico
Moyenne
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1595
TA0007
TA0001
Protocole
GET /favicon.ico UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/favicon.ico
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
5200
Chemin / cible
/favicon.ico
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 40
Confiance : Confiance 95 % — Motif catalogue confirmé
Signaux
Requête favicon.ico
Single Port
Chemin bénin connu
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /favicon.ico HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /favicon.ico HTTP/1.1
Host: 62.3.50.33:5200
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "ico",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "dcb8e77c9218e9a917610813114a840c24f7110b",
"http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 126,
"payload_entropy": 4.916930816595585,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "US",
"dst_port": 5200,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "6ecf3b672e89fb60e45e924322318018e60e4beb",
"event_fingerprint": "11ccb68250ae811042844b1ee89b78a5a265bd4e",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 94,
"precision_signals": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"kb_rule_ids": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "66c520b92eaab4b71e08b9eda0a996b2",
"path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a"
},
"target_context": {
"dst_port": 5200,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:5200\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/favicon.ico",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:5200\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:5200\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/favicon.ico",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:5200\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:5200\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "77c53a87341f7c0f928854516199af8f88284af9",
"protocol_details": {
"http_method": "GET",
"http_path": "\/favicon.ico",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 5200,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:5200\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:5200 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
"target_port_label": "5200 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5200,
"protocol_emulated": null,
"tags_summary": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"tags_summary_labels_fr": [
"Requ\u00eate favicon.ico",
"Single Port",
"Chemin b\u00e9nin connu"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/favicon.ico",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 5200,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:5200 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
"evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:5200\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"target_port_label": "5200 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5200"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
],
"behavior_alert_count": 1,
"behavior_priority": 84
}
08/06/2026 13:36:48 UTC
TCP
5633 · HTTP
Sonde HTTP
Sonde HTTP · via HTTP:5633 · (sonde / probe) · → /robots.txt
Moyenne
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1595
TA0007
TA0001
Protocole
GET /robots.txt UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/robots.txt
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
5633
Chemin / cible
/robots.txt
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 40
Confiance : Confiance 95 % — Motif catalogue confirmé
Signaux
Requête robots.txt
Single Port
Chemin bénin connu
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /robots.txt HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /robots.txt HTTP/1.1
Host: 62.3.50.33:5633
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "txt",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "b30483e0a4d2e346891562aeb7a39c7bf458dfcf",
"http_target_hash": "b7a9adb9fec4116c29da690c45d9a67df535af9d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 125,
"payload_entropy": 4.88443831356796,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "US",
"dst_port": 5633,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.9,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "0ba0e1dca3d0d86cde7ee445eeb5d862407d7f86",
"event_fingerprint": "50a8a5dfa7b787164dc78534f1748ad0804ca5e0",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 94,
"precision_signals": [
"INT-benign-robots",
"INT-single-port",
"INT-benign-path-cap"
],
"kb_rule_ids": [
"INT-benign-robots",
"INT-single-port",
"INT-benign-path-cap"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "52c9ca05a851894dcb8a63ad1b542aed",
"path_pattern_hash": "adada1317532a28bebf63fe6edbea3e4"
},
"target_context": {
"dst_port": 5633,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:5633\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:5633\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:5633\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:5633\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:5633\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ca4d8b7e28d7884335b4ce56c069996c988a69e5",
"protocol_details": {
"http_method": "GET",
"http_path": "\/robots.txt",
"request_line": "GET \/robots.txt HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 5633,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:5633\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:5633 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/robots.txt",
"target_port_label": "5633 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5633,
"protocol_emulated": null,
"tags_summary": [
"INT-benign-robots",
"INT-single-port",
"INT-benign-path-cap"
],
"tags_summary_labels_fr": [
"Requ\u00eate robots.txt",
"Single Port",
"Chemin b\u00e9nin connu"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/robots.txt",
"request_line": "GET \/robots.txt HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 5633,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:5633 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/robots.txt",
"evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:5633\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"target_port_label": "5633 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5633"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
08/06/2026 13:36:48 UTC
TCP
5633 · HTTP
Sonde HTTP
Sonde HTTP · via HTTP:5633 · (sonde / probe) · → /sitemap.xml
Moyenne
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1595
TA0007
TA0001
Protocole
GET /sitemap.xml UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/sitemap.xml
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
5633
Chemin / cible
/sitemap.xml
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 40
Confiance : Confiance 95 % — Motif catalogue confirmé
Signaux
Requête sitemap.xml
Single Port
Chemin bénin connu
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /sitemap.xml HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /sitemap.xml HTTP/1.1
Host: 62.3.50.33:5633
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "xml",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "b30483e0a4d2e346891562aeb7a39c7bf458dfcf",
"http_target_hash": "aefeebe85207f9638bc792aa32d2470b82e35120",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 126,
"payload_entropy": 4.94386650789093,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "US",
"dst_port": 5633,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.9,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "0ba0e1dca3d0d86cde7ee445eeb5d862407d7f86",
"event_fingerprint": "ba4a606eb4575a315d1de43ec42579729cf80b2d",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 92,
"precision_signals": [
"INT-benign-sitemap",
"INT-single-port",
"INT-benign-path-cap"
],
"kb_rule_ids": [
"INT-benign-sitemap",
"INT-single-port",
"INT-benign-path-cap"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "ae75ebad339a170e378f49f0952b9a4e",
"path_pattern_hash": "7efd2a819481844ebcfd47a818831daf"
},
"target_context": {
"dst_port": 5633,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:5633\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/sitemap.xml",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:5633\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:5633\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/sitemap.xml",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:5633\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:5633\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e0920fe93dbfe036afd7908480005d085eeafb84",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sitemap.xml",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 5633,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:5633\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:5633 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
"target_port_label": "5633 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5633,
"protocol_emulated": null,
"tags_summary": [
"INT-benign-sitemap",
"INT-single-port",
"INT-benign-path-cap"
],
"tags_summary_labels_fr": [
"Requ\u00eate sitemap.xml",
"Single Port",
"Chemin b\u00e9nin connu"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/sitemap.xml",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 5633,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:5633 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
"evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:5633\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"target_port_label": "5633 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5633"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
08/06/2026 13:36:47 UTC
TCP
5633 · HTTP
Tentative d'exploit
exploit attempt · via HTTP:5633 · (tentative d'exploit)
Élevée
Moyen · 47
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/566.44 (KHTML, like…
Émulateur
HTTP
WAF
16
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
5633
Chemin / cible
/
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
62%
Risque capteur
Moyen
· 47
Confiance : Confiance 62 % — 3 tag(s) WAF
Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/566.44 (KHTML, like Gecko) Chrome/80.0.1402 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:5633
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/566.44 (KHTML, like Gecko) Chrome
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:5633 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/566.44 (KHTML, like Gecko) Chrome/80.0.1402 Safari/537.36 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "35fac5008738f360d3187624e48e1bb9bf3c2c58",
"http_host_hash": "b30483e0a4d2e346891562aeb7a39c7bf458dfcf",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 198,
"payload_entropy": 5.40949456888718,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "US",
"dst_port": 5633,
"risk_waf": 72,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 47,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "eed24538c59f909dd40458d42d9de8b2be498a5a",
"event_fingerprint": "85c8bf980fd2d4362dd9977f5776006b24350973",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence": 0.62,
"classification_confidence": 0.62,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"confidence_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 47
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "0b84d4a4bdbf267b97488ddc95c60965",
"payload_hash": "99fadb8d991a05b7340dec241889c29e",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 5633,
"service": "http",
"service_name": "http",
"risk_score": 47
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5633\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/566.44 (KHTML, like Gecko) Chrome",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/566.44 (KHTML, like Gecko) Chrome\/80.0.1402 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5633\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/566.44 (KHTML, like Gecko) Chrome\/80.0.1402 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5633\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/566.44 (KHTML, like Gecko) Chrome",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/566.44 (KHTML, like Gecko) Chrome\/80.0.1402 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5633\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/566.44 (KHTML, like Gecko) Chrome\/80.0.1402 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5633\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/566.44 (KHTML, like Gecko) Chrome",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fd9ffd9acfe2c813ea5312208426cd2873ab8095",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/566.44 (KHTML, like Gecko) Chrome\/80.0.1402 Safari\/537.36",
"port": 5633,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5633\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/566.44 (KHTML, like Gecko) Chrome",
"attack_vector": "exploit attempt \u00b7 via HTTP:5633 \u00b7 (tentative d'exploit)",
"target_port_label": "5633 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP",
"confidence_pct": 62,
"confidence_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 47
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 47,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5633,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1190"
],
"tags_summary_labels_fr": [
"MITRE-T1190"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/566.44 (KHTML, like Gecko) Chrome\/80.0.1402 Safari\/537.36",
"port": 5633,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "exploit attempt \u00b7 via HTTP:5633 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5633\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/566.44 (KHTML, like Gecko) Chrome",
"target_port_label": "5633 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5633"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"behavior_alert_count": 1,
"behavior_priority": 72
}
08/06/2026 13:36:47 UTC
TCP
5633 · HTTP
Sonde HTTP
Sonde HTTP · via HTTP:5633 · (sonde / probe) · → /favicon.ico
Moyenne
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1595
TA0007
TA0001
Protocole
GET /favicon.ico UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/favicon.ico
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
5633
Chemin / cible
/favicon.ico
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 40
Confiance : Confiance 95 % — Motif catalogue confirmé
Signaux
Requête favicon.ico
Single Port
Chemin bénin connu
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /favicon.ico HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /favicon.ico HTTP/1.1
Host: 62.3.50.33:5633
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "ico",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "b30483e0a4d2e346891562aeb7a39c7bf458dfcf",
"http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 126,
"payload_entropy": 4.900265217626458,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "US",
"dst_port": 5633,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.9,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "0ba0e1dca3d0d86cde7ee445eeb5d862407d7f86",
"event_fingerprint": "2f15760ae7145588942ad4605ac7c10d6d150186",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 94,
"precision_signals": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"kb_rule_ids": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "e162a20e0207488cd65f1835fb14a929",
"path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a"
},
"target_context": {
"dst_port": 5633,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:5633\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/favicon.ico",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:5633\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:5633\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/favicon.ico",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:5633\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:5633\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b72191c0bdee908c2d9185147b3932ab784c6252",
"protocol_details": {
"http_method": "GET",
"http_path": "\/favicon.ico",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 5633,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:5633\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:5633 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
"target_port_label": "5633 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5633,
"protocol_emulated": null,
"tags_summary": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"tags_summary_labels_fr": [
"Requ\u00eate favicon.ico",
"Single Port",
"Chemin b\u00e9nin connu"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/favicon.ico",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 5633,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:5633 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
"evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:5633\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"target_port_label": "5633 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5633"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
],
"behavior_alert_count": 1,
"behavior_priority": 84
}
08/06/2026 12:21:03 UTC
TCP
1368 · HTTP
Sonde HTTP
Sonde HTTP · via HTTP:1368 · (sonde / probe) · → /robots.txt
Moyenne
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1595
TA0007
TA0001
Protocole
GET /robots.txt UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/robots.txt
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
1368
Chemin / cible
/robots.txt
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 40
Confiance : Confiance 95 % — Motif catalogue confirmé
Signaux
Requête robots.txt
Single Port
Chemin bénin connu
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /robots.txt HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /robots.txt HTTP/1.1
Host: 62.3.50.33:1368
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "txt",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "bed0e9d9d1d3a77e093ad2ac39e70fe9e61c04c6",
"http_target_hash": "b7a9adb9fec4116c29da690c45d9a67df535af9d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 125,
"payload_entropy": 4.900438313567961,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "US",
"dst_port": 1368,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "3bfad4210ee15ed5a414b64eede01a05c6db1169",
"event_fingerprint": "49c777e37d4aa2afb1e66cf037dea895f7be24f4",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 94,
"precision_signals": [
"INT-benign-robots",
"INT-single-port",
"INT-benign-path-cap"
],
"kb_rule_ids": [
"INT-benign-robots",
"INT-single-port",
"INT-benign-path-cap"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "eb8196417e9800c459985ee96998c961",
"path_pattern_hash": "adada1317532a28bebf63fe6edbea3e4"
},
"target_context": {
"dst_port": 1368,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:1368\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:1368\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:1368\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:1368\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:1368\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0af52b4a2fdf867e4f12b3baaf1f7705c4208a85",
"protocol_details": {
"http_method": "GET",
"http_path": "\/robots.txt",
"request_line": "GET \/robots.txt HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 1368,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:1368\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:1368 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/robots.txt",
"target_port_label": "1368 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 1368,
"protocol_emulated": null,
"tags_summary": [
"INT-benign-robots",
"INT-single-port",
"INT-benign-path-cap"
],
"tags_summary_labels_fr": [
"Requ\u00eate robots.txt",
"Single Port",
"Chemin b\u00e9nin connu"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/robots.txt",
"request_line": "GET \/robots.txt HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 1368,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:1368 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/robots.txt",
"evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:1368\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"target_port_label": "1368 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "1368"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
08/06/2026 12:21:03 UTC
TCP
1368 · HTTP
Sonde HTTP
Sonde HTTP · via HTTP:1368 · (sonde / probe) · → /sitemap.xml
Moyenne
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1595
TA0007
TA0001
Protocole
GET /sitemap.xml UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/sitemap.xml
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
1368
Chemin / cible
/sitemap.xml
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 40
Confiance : Confiance 95 % — Motif catalogue confirmé
Signaux
Requête sitemap.xml
Single Port
Chemin bénin connu
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /sitemap.xml HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /sitemap.xml HTTP/1.1
Host: 62.3.50.33:1368
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "xml",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "bed0e9d9d1d3a77e093ad2ac39e70fe9e61c04c6",
"http_target_hash": "aefeebe85207f9638bc792aa32d2470b82e35120",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 126,
"payload_entropy": 4.959739523763947,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "US",
"dst_port": 1368,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "3bfad4210ee15ed5a414b64eede01a05c6db1169",
"event_fingerprint": "690c2359c937a2bc06493bb13e9a4287454429e3",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 92,
"precision_signals": [
"INT-benign-sitemap",
"INT-single-port",
"INT-benign-path-cap"
],
"kb_rule_ids": [
"INT-benign-sitemap",
"INT-single-port",
"INT-benign-path-cap"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "e7d9fb0f8b29f4ed354814f92b3ef5fe",
"path_pattern_hash": "7efd2a819481844ebcfd47a818831daf"
},
"target_context": {
"dst_port": 1368,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:1368\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/sitemap.xml",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:1368\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:1368\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/sitemap.xml",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:1368\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:1368\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "939bb8a15da48b3e6e9ac9050fbfcafb1ab35cbb",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sitemap.xml",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 1368,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:1368\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:1368 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
"target_port_label": "1368 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 1368,
"protocol_emulated": null,
"tags_summary": [
"INT-benign-sitemap",
"INT-single-port",
"INT-benign-path-cap"
],
"tags_summary_labels_fr": [
"Requ\u00eate sitemap.xml",
"Single Port",
"Chemin b\u00e9nin connu"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/sitemap.xml",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 1368,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:1368 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
"evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:1368\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"target_port_label": "1368 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "1368"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
08/06/2026 12:21:02 UTC
TCP
1368 · HTTP
Tentative d'exploit
exploit attempt · via HTTP:1368 · (tentative d'exploit)
Élevée
Moyen · 44
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 8_2_2) AppleWebKit/543.3…
Émulateur
HTTP
WAF
16
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
1368
Chemin / cible
/
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
62%
Risque capteur
Moyen
· 44
Confiance : Confiance 62 % — 3 tag(s) WAF
Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 8_2_2) AppleWebKit/543.35 (KHTML, like Gecko) Chrome/81.0.2138 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:1368
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 8_2_2) AppleWebKit/543.35 (KHTML, like
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:1368 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 8_2_2) AppleWebKit/543.35 (KHTML, like Gecko) Chrome/81.0.2138 Safari/537.36 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "e2bf7af94968c729bb601e3bf5db7113ecab042b",
"http_host_hash": "bed0e9d9d1d3a77e093ad2ac39e70fe9e61c04c6",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 212,
"payload_entropy": 5.372454208089833,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "US",
"dst_port": 1368,
"risk_waf": 72,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.7,
"risk_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 44,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "8e5b51051ed23be597b207d2de0d563c0cc6e7de",
"event_fingerprint": "adfda55c90b7d3f3b8817e66f427051ebb0e5bb5",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence": 0.62,
"classification_confidence": 0.62,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"confidence_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 44
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "9ce4530cb242f0738da144e255a63325",
"payload_hash": "382796133349108d69a2b0479c5e388b",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 1368,
"service": "http",
"service_name": "http",
"risk_score": 44
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1368\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_2_2) AppleWebKit\/543.35 (KHTML, like",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_2_2) AppleWebKit\/543.35 (KHTML, like Gecko) Chrome\/81.0.2138 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1368\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_2_2) AppleWebKit\/543.35 (KHTML, like Gecko) Chrome\/81.0.2138 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1368\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_2_2) AppleWebKit\/543.35 (KHTML, like",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_2_2) AppleWebKit\/543.35 (KHTML, like Gecko) Chrome\/81.0.2138 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1368\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_2_2) AppleWebKit\/543.35 (KHTML, like Gecko) Chrome\/81.0.2138 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1368\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_2_2) AppleWebKit\/543.35 (KHTML, like",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d2ec4722430f102a84c1f3383a4723298fc0079a",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_2_2) AppleWebKit\/543.35 (KHTML, like Gecko) Chrome\/81.0.2138 Safari\/537.36",
"port": 1368,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1368\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_2_2) AppleWebKit\/543.35 (KHTML, like",
"attack_vector": "exploit attempt \u00b7 via HTTP:1368 \u00b7 (tentative d'exploit)",
"target_port_label": "1368 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 44\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP",
"confidence_pct": 62,
"confidence_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 44
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 1368,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1190"
],
"tags_summary_labels_fr": [
"MITRE-T1190"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_2_2) AppleWebKit\/543.35 (KHTML, like Gecko) Chrome\/81.0.2138 Safari\/537.36",
"port": 1368,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "exploit attempt \u00b7 via HTTP:1368 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1368\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_2_2) AppleWebKit\/543.35 (KHTML, like",
"target_port_label": "1368 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "1368"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
]
}
08/06/2026 12:21:02 UTC
TCP
1368 · HTTP
Sonde HTTP
Sonde HTTP · via HTTP:1368 · (sonde / probe) · → /favicon.ico
Moyenne
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1595
TA0007
TA0001
Protocole
GET /favicon.ico UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/favicon.ico
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
1368
Chemin / cible
/favicon.ico
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 40
Confiance : Confiance 95 % — Motif catalogue confirmé
Signaux
Requête favicon.ico
Single Port
Chemin bénin connu
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /favicon.ico HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /favicon.ico HTTP/1.1
Host: 62.3.50.33:1368
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "ico",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "bed0e9d9d1d3a77e093ad2ac39e70fe9e61c04c6",
"http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 126,
"payload_entropy": 4.916138233499475,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "US",
"dst_port": 1368,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "3bfad4210ee15ed5a414b64eede01a05c6db1169",
"event_fingerprint": "15ca9436c98c8c6ea26db8f4add9c2750eb05d4f",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 94,
"precision_signals": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"kb_rule_ids": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "f51f4e036132961cc19caaebffb6bac2",
"path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a"
},
"target_context": {
"dst_port": 1368,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:1368\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/favicon.ico",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:1368\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:1368\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/favicon.ico",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:1368\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:1368\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "424c6f8402b9d3e033e23282e660b4fba38a7e34",
"protocol_details": {
"http_method": "GET",
"http_path": "\/favicon.ico",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 1368,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:1368\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:1368 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
"target_port_label": "1368 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 1368,
"protocol_emulated": null,
"tags_summary": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"tags_summary_labels_fr": [
"Requ\u00eate favicon.ico",
"Single Port",
"Chemin b\u00e9nin connu"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/favicon.ico",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 1368,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:1368 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
"evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:1368\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"target_port_label": "1368 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "1368"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
],
"behavior_alert_count": 1,
"behavior_priority": 84
}
08/06/2026 07:49:58 UTC
TCP
7544 · HTTP
Tentative d'exploit
exploit attempt · via HTTP:7544 · (tentative d'exploit)
Élevée
Moyen · 45
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Windows NT 7_0_1; Win64; x64) AppleWebKit/539.41 (…
Émulateur
HTTP
WAF
16
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
7544
Chemin / cible
/
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
62%
Risque capteur
Moyen
· 45
Confiance : Confiance 62 % — 3 tag(s) WAF
Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 7_0_1; Win64; x64) AppleWebKit/539.41 (KHTML, like Gecko) Chrome/50.0.2846 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:7544
User-Agent: Mozilla/5.0 (Windows NT 7_0_1; Win64; x64) AppleWebKit/539.41 (KHTML, like Ge
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:7544 User-Agent: Mozilla/5.0 (Windows NT 7_0_1; Win64; x64) AppleWebKit/539.41 (KHTML, like Gecko) Chrome/50.0.2846 Safari/537.36 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "c737e2431021a5468d974876faa0e450cabb07b0",
"http_host_hash": "7118df5b3093c53113ea62245f62aaa4dd679e1f",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 209,
"payload_entropy": 5.43078207619033,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "US",
"dst_port": 7544,
"risk_waf": 72,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "9e2f4cb6d4eec726640a5e78966e0296520ea86f",
"event_fingerprint": "814371034e534c3b5d7fbad7c6e5f1086d7c1688",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence": 0.62,
"classification_confidence": 0.62,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"confidence_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ab0084f9751fd9dec228b0495669dd68",
"payload_hash": "fec35904f7d010728be71ad5a2bfe3f3",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 7544,
"service": "http",
"service_name": "http",
"risk_score": 45
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7544\r\nUser-Agent: Mozilla\/5.0 (Windows NT 7_0_1; Win64; x64) AppleWebKit\/539.41 (KHTML, like Ge",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 7_0_1; Win64; x64) AppleWebKit\/539.41 (KHTML, like Gecko) Chrome\/50.0.2846 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7544\r\nUser-Agent: Mozilla\/5.0 (Windows NT 7_0_1; Win64; x64) AppleWebKit\/539.41 (KHTML, like Gecko) Chrome\/50.0.2846 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7544\r\nUser-Agent: Mozilla\/5.0 (Windows NT 7_0_1; Win64; x64) AppleWebKit\/539.41 (KHTML, like Ge",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 7_0_1; Win64; x64) AppleWebKit\/539.41 (KHTML, like Gecko) Chrome\/50.0.2846 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7544\r\nUser-Agent: Mozilla\/5.0 (Windows NT 7_0_1; Win64; x64) AppleWebKit\/539.41 (KHTML, like Gecko) Chrome\/50.0.2846 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7544\r\nUser-Agent: Mozilla\/5.0 (Windows NT 7_0_1; Win64; x64) AppleWebKit\/539.41 (KHTML, like Ge",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3fa3144d4eb7b8bd695a3b91f0d76a9c26359315",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 7_0_1; Win64; x64) AppleWebKit\/539.41 (KHTML, like Gecko) Chrome\/50.0.2846 Safari\/537.36",
"port": 7544,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7544\r\nUser-Agent: Mozilla\/5.0 (Windows NT 7_0_1; Win64; x64) AppleWebKit\/539.41 (KHTML, like Ge",
"attack_vector": "exploit attempt \u00b7 via HTTP:7544 \u00b7 (tentative d'exploit)",
"target_port_label": "7544 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 45\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP",
"confidence_pct": 62,
"confidence_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7544,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1190"
],
"tags_summary_labels_fr": [
"MITRE-T1190"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 7_0_1; Win64; x64) AppleWebKit\/539.41 (KHTML, like Gecko) Chrome\/50.0.2846 Safari\/537.36",
"port": 7544,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "exploit attempt \u00b7 via HTTP:7544 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7544\r\nUser-Agent: Mozilla\/5.0 (Windows NT 7_0_1; Win64; x64) AppleWebKit\/539.41 (KHTML, like Ge",
"target_port_label": "7544 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7544"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
]
}
08/06/2026 07:49:58 UTC
TCP
7544 · HTTP
Sonde HTTP
Sonde HTTP · via HTTP:7544 · (sonde / probe) · → /favicon.ico
Moyenne
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1595
TA0007
TA0001
Protocole
GET /favicon.ico UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/favicon.ico
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
7544
Chemin / cible
/favicon.ico
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 40
Confiance : Confiance 95 % — Motif catalogue confirmé
Signaux
Requête favicon.ico
Single Port
Chemin bénin connu
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /favicon.ico HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /favicon.ico HTTP/1.1
Host: 62.3.50.33:7544
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "ico",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "7118df5b3093c53113ea62245f62aaa4dd679e1f",
"http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 126,
"payload_entropy": 4.954668018993708,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "US",
"dst_port": 7544,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.1,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "be9185cdbd54a432b31e8c531a75ba7206cb5b72",
"event_fingerprint": "b9d7fe02b1da3290ca9c56ae42b4187832ef196d",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 94,
"precision_signals": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"kb_rule_ids": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "0d198fc0cd546be31b9781b80ae3683b",
"path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a"
},
"target_context": {
"dst_port": 7544,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:7544\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/favicon.ico",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:7544\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:7544\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/favicon.ico",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:7544\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:7544\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ef3cea281a6387f39075a340cc20828802f2c975",
"protocol_details": {
"http_method": "GET",
"http_path": "\/favicon.ico",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 7544,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:7544\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:7544 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
"target_port_label": "7544 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7544,
"protocol_emulated": null,
"tags_summary": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"tags_summary_labels_fr": [
"Requ\u00eate favicon.ico",
"Single Port",
"Chemin b\u00e9nin connu"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/favicon.ico",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 7544,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:7544 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
"evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:7544\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"target_port_label": "7544 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7544"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
],
"behavior_alert_count": 1,
"behavior_priority": 84
}
08/06/2026 07:49:58 UTC
TCP
7544 · HTTP
Sonde HTTP
Sonde HTTP · via HTTP:7544 · (sonde / probe) · → /sitemap.xml
Moyenne
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1595
TA0007
TA0001
Protocole
GET /sitemap.xml UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/sitemap.xml
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
7544
Chemin / cible
/sitemap.xml
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 40
Confiance : Confiance 95 % — Motif catalogue confirmé
Signaux
Requête sitemap.xml
Single Port
Chemin bénin connu
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /sitemap.xml HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /sitemap.xml HTTP/1.1
Host: 62.3.50.33:7544
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "xml",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "7118df5b3093c53113ea62245f62aaa4dd679e1f",
"http_target_hash": "aefeebe85207f9638bc792aa32d2470b82e35120",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 126,
"payload_entropy": 4.99826930925818,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "US",
"dst_port": 7544,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.1,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "be9185cdbd54a432b31e8c531a75ba7206cb5b72",
"event_fingerprint": "f200287372c4ac6ca86b0be32107db40e6d6e153",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 92,
"precision_signals": [
"INT-benign-sitemap",
"INT-single-port",
"INT-benign-path-cap"
],
"kb_rule_ids": [
"INT-benign-sitemap",
"INT-single-port",
"INT-benign-path-cap"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "c10890f0f536a8f00a9d7d8392102c31",
"path_pattern_hash": "7efd2a819481844ebcfd47a818831daf"
},
"target_context": {
"dst_port": 7544,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:7544\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/sitemap.xml",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:7544\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:7544\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/sitemap.xml",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:7544\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:7544\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "42d7eb26050bbc967aa81d6874a62c6f027c9a1e",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sitemap.xml",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 7544,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:7544\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:7544 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
"target_port_label": "7544 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7544,
"protocol_emulated": null,
"tags_summary": [
"INT-benign-sitemap",
"INT-single-port",
"INT-benign-path-cap"
],
"tags_summary_labels_fr": [
"Requ\u00eate sitemap.xml",
"Single Port",
"Chemin b\u00e9nin connu"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/sitemap.xml",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 7544,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:7544 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
"evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:7544\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"target_port_label": "7544 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7544"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
08/06/2026 07:49:58 UTC
TCP
7544 · HTTP
Sonde HTTP
Sonde HTTP · via HTTP:7544 · (sonde / probe) · → /robots.txt
Moyenne
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1595
TA0007
TA0001
Protocole
GET /robots.txt UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/robots.txt
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
7544
Chemin / cible
/robots.txt
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 40
Confiance : Confiance 95 % — Motif catalogue confirmé
Signaux
Requête robots.txt
Single Port
Chemin bénin connu
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /robots.txt HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /robots.txt HTTP/1.1
Host: 62.3.50.33:7544
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "txt",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "7118df5b3093c53113ea62245f62aaa4dd679e1f",
"http_target_hash": "b7a9adb9fec4116c29da690c45d9a67df535af9d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 125,
"payload_entropy": 4.939276337346148,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "US",
"dst_port": 7544,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.1,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "be9185cdbd54a432b31e8c531a75ba7206cb5b72",
"event_fingerprint": "f304fa40055fafabcb3f4f7e022fc182fd4dc342",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 94,
"precision_signals": [
"INT-benign-robots",
"INT-single-port",
"INT-benign-path-cap"
],
"kb_rule_ids": [
"INT-benign-robots",
"INT-single-port",
"INT-benign-path-cap"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "bb8b844142e6f9d423c2fe84286b0680",
"path_pattern_hash": "adada1317532a28bebf63fe6edbea3e4"
},
"target_context": {
"dst_port": 7544,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:7544\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:7544\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:7544\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:7544\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:7544\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8a23bc9f256f23fc08a000d59b7cad7194e3ac38",
"protocol_details": {
"http_method": "GET",
"http_path": "\/robots.txt",
"request_line": "GET \/robots.txt HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 7544,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:7544\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:7544 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/robots.txt",
"target_port_label": "7544 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7544,
"protocol_emulated": null,
"tags_summary": [
"INT-benign-robots",
"INT-single-port",
"INT-benign-path-cap"
],
"tags_summary_labels_fr": [
"Requ\u00eate robots.txt",
"Single Port",
"Chemin b\u00e9nin connu"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/robots.txt",
"request_line": "GET \/robots.txt HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 7544,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:7544 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/robots.txt",
"evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:7544\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"target_port_label": "7544 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7544"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
08/06/2026 03:49:50 UTC
TCP
20188
—
Sonde port
Sonde port · port 20188 · (sonde / probe)
Faible
Moyen · 44
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
20188
Chemin / cible
—
Payload
t3 12.1.2 AS:2048 HL:19
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
t3 12.1.2
AS:2048
HL:19
Meta JSON brut
{
"bytes_in": 25,
"payload_entropy": 3.7834651896016456,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": null,
"app_proto": null,
"asn": 135377,
"country": "US",
"dst_port": 20188,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.1,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "93576509c284c9b39ce6f7ab935982af6e99d607",
"event_fingerprint": "672b40ab31d13c6bb038a45981355a39172f2835",
"classification_confidence": 0.58,
"confidence": 0.58,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44,
"correlation_boost": 8
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "588580493dbf1d2ca7cd7f2cd09ed672",
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 20188,
"risk_score": 44
},
"payload_preview": "t3 12.1.2\nAS:2048\nHL:19\n\n",
"request_sample": "t3 12.1.2\nAS:2048\nHL:19\n\n",
"payload_snippet": "t3 12.1.2\nAS:2048\nHL:19",
"evidence": {
"request_sample": "t3 12.1.2\nAS:2048\nHL:19\n\n",
"payload_snippet": "t3 12.1.2\nAS:2048\nHL:19",
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "561729ff55a66796be3071c270929618d3a8b4dc",
"protocol_details": {
"payload_preview": "t3 12.1.2\nAS:2048\nHL:19",
"port": 20188
},
"evidence_snippet": "t3 12.1.2\nAS:2048\nHL:19",
"attack_vector": "Sonde port \u00b7 port 20188 \u00b7 (sonde \/ probe)",
"target_port_label": "20188",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 20188,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "t3 12.1.2\nAS:2048\nHL:19",
"port": 20188
},
"attack_vector": "Sonde port \u00b7 port 20188 \u00b7 (sonde \/ probe)",
"evidence_snippet": "t3 12.1.2\nAS:2048\nHL:19",
"target_port_label": "20188",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "20188"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:20188",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
08/06/2026 03:49:49 UTC
TCP
20188 · TLS
Sonde PostgreSQL
postgres probe · via TLS:20188 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 9460af62ae0af667
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
20188
Chemin / cible
—
Service
TLS
Payload
� ���X�"�h����[;�����!N�ϒ��� ��ty����c�A��Q㣏w8��蔕�N� &�+�/�,�0̨̩� �� � � � / 5� �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���X�"�h����[;�����!N�ϒ��� ��ty����c�A��Q㣏w8��蔕�N� &�+�/�,�0̨̩� ��
� � � / 5�
�
Requête brute (extrait)
� ���X�"�h����[;�����!N�ϒ��� ��ty����c�A��Q㣏w8��蔕�N� &�+�/�,�0̨̩� �� � � � / 5� � + 3 & $ �g��EZ�>������1�7>���o���ZՀoR
Meta JSON brut
{
"tls_ja3_hash": "9460af62ae0af667130bf0d36514f084",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 247,
"payload_entropy": 5.851798563200462,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "tls",
"app_proto": "tls",
"asn": 135377,
"country": "US",
"dst_port": 20188,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "f6140d6716e793a6419fe8a556645ba46f9417c4",
"event_fingerprint": "701f82f777bdceef175fbf309057f7c32bce0f11",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "9460af62ae0af667130bf0d36514f084",
"payload_hash": "d5446192975357193fb838c9cf142055",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "9d78dfefabcee3ee16297d72e4cafc86",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,11-65281-23-18-5-10-13-43-51,29-23-24-25,0",
"tls_ja4_hash": "9d78dfefabcee3ee16297d72e4cafc86",
"tls_ja4": "t13d0119_e060b20e9557_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 20188,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdX\ufffd\"\u0001\ufffdh\ufffd\ufffd\ufffd\ufffd[;\u0003\u0005\ufffd\ufffd\ufffd\ufffd\ufffd!\u0015N\ufffd\u03d2\ufffd\ufffd\ufffd \ufffd\ufffd\u0007ty\ufffd\ufffd\ufffd\ufffdc\ufffdA\ufffd\ufffd\u000e\uf588Q\u38cfw8\ufffd\ufffd\u8515\ufffdN\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdX\ufffd\"\u0001\ufffdh\ufffd\ufffd\ufffd\ufffd[;\u0003\u0005\ufffd\ufffd\ufffd\ufffd\ufffd!\u0015N\ufffd\u03d2\ufffd\ufffd\ufffd \ufffd\ufffd\u0007ty\ufffd\ufffd\ufffd\ufffdc\ufffdA\ufffd\ufffd\u000e\uf588Q\u38cfw8\ufffd\ufffd\u8515\ufffdN\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffdg\ufffd\ufffdEZ\ufffd\u0015>\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd1\ufffd7>\ufffd\ufffd\ufffdo\ufffd\ufffd\u0015\ufffdZ\u0540oR",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdX\ufffd\"\u0001\ufffdh\ufffd\ufffd\ufffd\ufffd[;\u0003\u0005\ufffd\ufffd\ufffd\ufffd\ufffd!\u0015N\ufffd\u03d2\ufffd\ufffd\ufffd \ufffd\ufffd\u0007ty\ufffd\ufffd\ufffd\ufffdc\ufffdA\ufffd\ufffd\u000e\uf588Q\u38cfw8\ufffd\ufffd\u8515\ufffdN\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c3570a08397aa0ce7dc859bc8eb4603b9c69ab09",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdX\ufffd\"\u0001\ufffdh\ufffd\ufffd\ufffd\ufffd[;\u0003\u0005\ufffd\ufffd\ufffd\ufffd\ufffd!\u0015N\ufffd\u03d2\ufffd\ufffd\ufffd \ufffd\ufffd\u0007ty\ufffd\ufffd\ufffd\ufffdc\ufffdA\ufffd\ufffd\u000e\uf588Q\u38cfw8\ufffd\ufffd\u8515\ufffdN\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"tls_ja3": "9460af62ae0af667130bf0d36514f084",
"tls_ja4": "9d78dfefabcee3ee16297d72e4cafc86",
"port": 20188,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdX\ufffd\"\ufffdh\ufffd\ufffd\ufffd\ufffd[;\ufffd\ufffd\ufffd\ufffd\ufffd!N\ufffd\u03d2\ufffd\ufffd\ufffd \ufffd\ufffdty\ufffd\ufffd\ufffd\ufffdc\ufffdA\ufffd\ufffd\uf588Q\u38cfw8\ufffd\ufffd\u8515\ufffdN\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd",
"attack_vector": "postgres probe \u00b7 via TLS:20188 \u00b7 (sonde \/ probe)",
"target_port_label": "20188 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 20188,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdX\ufffd\"\u0001\ufffdh\ufffd\ufffd\ufffd\ufffd[;\u0003\u0005\ufffd\ufffd\ufffd\ufffd\ufffd!\u0015N\ufffd\u03d2\ufffd\ufffd\ufffd \ufffd\ufffd\u0007ty\ufffd\ufffd\ufffd\ufffdc\ufffdA\ufffd\ufffd\u000e\uf588Q\u38cfw8\ufffd\ufffd\u8515\ufffdN\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"tls_ja3": "9460af62ae0af667130bf0d36514f084",
"tls_ja4": "9d78dfefabcee3ee16297d72e4cafc86",
"port": 20188,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:20188 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdX\ufffd\"\ufffdh\ufffd\ufffd\ufffd\ufffd[;\ufffd\ufffd\ufffd\ufffd\ufffd!N\ufffd\u03d2\ufffd\ufffd\ufffd \ufffd\ufffdty\ufffd\ufffd\ufffd\ufffdc\ufffdA\ufffd\ufffd\uf588Q\u38cfw8\ufffd\ufffd\u8515\ufffdN\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd",
"target_port_label": "20188 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "20188"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:20188",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
08/06/2026 03:49:48 UTC
TCP
20188 · HTTP
Sonde port 20188/TCP
port 20188 tcp · via HTTP:20188 · (sonde / probe)
Élevée
Moyen · 42
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
GET / UA curl/7.29.0
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
scanner-ua
anomaly:scanner-ua
botnet_http_ua_host
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
20188
Chemin / cible
/
Preuve honeypot — Sonde port 20188/TCP
Connexion détectée sur le port 20188 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_20188_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
63%
Corrélation +8
Risque capteur
Moyen
· 42
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET / HTTP/1.1
User-Agent
curl/7.29.0
Règles WAF
sap-sapcontrol-path
scanner-ua
Payload (extrait)
GET / HTTP/1.1
User-Agent: curl/7.29.0
Host: 62.3.50.33
Accept: */*
Meta JSON brut
{
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "0315d257123246273ce1f3edb87d478f00f3fce8",
"http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 74,
"payload_entropy": 4.819344967782759,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "US",
"dst_port": 20188,
"risk_waf": 32,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 0,
"risk_granularity": 2.9,
"risk_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 30
},
"risk_score": 42,
"tag_count": 5,
"anomaly_count": 1,
"campaign_key": "44e957f21defb4c1f7c1955fcd3ec42dbdc89675",
"event_fingerprint": "e39149b72bc679a543d878918f8794d001f51d58",
"classification_reason": "Type \u00ab port_20188_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.63,
"classification_confidence": 0.63,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 30,
"risk_score": 42,
"correlation_boost": 8
},
"named_classification_skipped": true,
"named_candidate": "web_scanner",
"service_name": "http",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "a6744e3c06a59e753fc74a2c54c4a161",
"payload_hash": "99559ea3a5e9ac33c4b35f9a75d06c9c",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 20188,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.29.0\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\n\r\n",
"method": "GET",
"path": "\/",
"user_agent": "curl\/7.29.0",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.29.0\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.29.0\r\nHost: 62.3.50.33\r\nAccept: *\/*",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "curl\/7.29.0",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.29.0\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.29.0\r\nHost: 62.3.50.33\r\nAccept: *\/*",
"classification_reason": "Type \u00ab port_20188_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "38aa3c26b5fc6a49354112afaca69bbb70668846",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "curl\/7.29.0",
"port": 20188,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.29.0\r\nHost: 62.3.50.33\r\nAccept: *\/*",
"attack_vector": "port 20188 tcp \u00b7 via HTTP:20188 \u00b7 (sonde \/ probe)",
"target_port_label": "20188 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_20188_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_20188_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100",
"confidence_pct": 63,
"confidence_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 30,
"risk_score": 42,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 20188,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "curl\/7.29.0",
"port": 20188,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 20188 tcp \u00b7 via HTTP:20188 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.29.0\r\nHost: 62.3.50.33\r\nAccept: *\/*",
"target_port_label": "20188 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 63 % \u2014 Score WAF 32 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "20188"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:20188"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"anomaly:scanner-ua",
"botnet_http_ua_host",
"http_ua_suspicious",
"scanner-ua"
]
}
08/06/2026 03:49:43 UTC
TCP
20188
—
Sonde port
Sonde port · port 20188 · (sonde / probe)
Faible
Moyen · 44
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
20188
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": null,
"app_proto": null,
"asn": 135377,
"country": "US",
"dst_port": 20188,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.1,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "93576509c284c9b39ce6f7ab935982af6e99d607",
"event_fingerprint": "672b40ab31d13c6bb038a45981355a39172f2835",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 20188,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d909ad374c678c62b96ab7f168763b6c5077da82",
"protocol_details": {
"port": 20188
},
"attack_vector": "Sonde port \u00b7 port 20188 \u00b7 (sonde \/ probe)",
"target_port_label": "20188",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 20188,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"port": 20188
},
"attack_vector": "Sonde port \u00b7 port 20188 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "20188",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "20188"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
08/06/2026 00:11:24 UTC
TCP
11600 · HTTP
Sonde HTTP
Sonde HTTP · via HTTP:11600 · (sonde / probe) · → /sitemap.xml
Moyenne
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1595
TA0007
TA0001
Protocole
GET /sitemap.xml UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/sitemap.xml
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
11600
Chemin / cible
/sitemap.xml
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 40
Confiance : Confiance 95 % — Motif catalogue confirmé
Signaux
Requête sitemap.xml
Single Port
Chemin bénin connu
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /sitemap.xml HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /sitemap.xml HTTP/1.1
Host: 62.3.50.33:11600
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "xml",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "35e516a14e2f3b8bd542afb95e103cc59aa0c964",
"http_target_hash": "aefeebe85207f9638bc792aa32d2470b82e35120",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 127,
"payload_entropy": 4.9444327190481525,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "US",
"dst_port": 11600,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.3,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "b599e133935ab0182918e0b4517251a18cdd6d4d",
"event_fingerprint": "77a693766a02034696bcde664f99484d613228d2",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 92,
"precision_signals": [
"INT-benign-sitemap",
"INT-single-port",
"INT-benign-path-cap"
],
"kb_rule_ids": [
"INT-benign-sitemap",
"INT-single-port",
"INT-benign-path-cap"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "570330639f6318d6e3c0a6f3474b62d9",
"path_pattern_hash": "7efd2a819481844ebcfd47a818831daf"
},
"target_context": {
"dst_port": 11600,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:11600\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/sitemap.xml",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:11600\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:11600\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/sitemap.xml",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:11600\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:11600\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8fd190a426bfd6364381f579cbff3f58e6203fac",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sitemap.xml",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 11600,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:11600\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:11600 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
"target_port_label": "11600 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 11600,
"protocol_emulated": null,
"tags_summary": [
"INT-benign-sitemap",
"INT-single-port",
"INT-benign-path-cap"
],
"tags_summary_labels_fr": [
"Requ\u00eate sitemap.xml",
"Single Port",
"Chemin b\u00e9nin connu"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/sitemap.xml",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 11600,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:11600 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
"evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:11600\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"target_port_label": "11600 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "11600"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
08/06/2026 00:11:24 UTC
TCP
11600 · HTTP
Sonde HTTP
Sonde HTTP · via HTTP:11600 · (sonde / probe) · → /robots.txt
Moyenne
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1595
TA0007
TA0001
Protocole
GET /robots.txt UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/robots.txt
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
11600
Chemin / cible
/robots.txt
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 40
Confiance : Confiance 95 % — Motif catalogue confirmé
Signaux
Requête robots.txt
Single Port
Chemin bénin connu
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /robots.txt HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /robots.txt HTTP/1.1
Host: 62.3.50.33:11600
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "txt",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "35e516a14e2f3b8bd542afb95e103cc59aa0c964",
"http_target_hash": "b7a9adb9fec4116c29da690c45d9a67df535af9d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 126,
"payload_entropy": 4.885389797142909,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "US",
"dst_port": 11600,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.3,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "b599e133935ab0182918e0b4517251a18cdd6d4d",
"event_fingerprint": "007f126cece9061e3ee43c36106b7833412c76aa",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 94,
"precision_signals": [
"INT-benign-robots",
"INT-single-port",
"INT-benign-path-cap"
],
"kb_rule_ids": [
"INT-benign-robots",
"INT-single-port",
"INT-benign-path-cap"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "69c4357b2dcdd34215e0fddff19cdb5f",
"path_pattern_hash": "adada1317532a28bebf63fe6edbea3e4"
},
"target_context": {
"dst_port": 11600,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:11600\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:11600\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:11600\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:11600\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:11600\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0363352262af5581d89093bc860d819271fb3b72",
"protocol_details": {
"http_method": "GET",
"http_path": "\/robots.txt",
"request_line": "GET \/robots.txt HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 11600,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:11600\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:11600 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/robots.txt",
"target_port_label": "11600 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 11600,
"protocol_emulated": null,
"tags_summary": [
"INT-benign-robots",
"INT-single-port",
"INT-benign-path-cap"
],
"tags_summary_labels_fr": [
"Requ\u00eate robots.txt",
"Single Port",
"Chemin b\u00e9nin connu"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/robots.txt",
"request_line": "GET \/robots.txt HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 11600,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:11600 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/robots.txt",
"evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:11600\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"target_port_label": "11600 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "11600"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
08/06/2026 00:11:23 UTC
TCP
11600 · HTTP
Tentative d'exploit
exploit attempt · via HTTP:11600 · (tentative d'exploit)
Élevée
Moyen · 44
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Windows NT 7_1; Win64; x64) AppleWebKit/559.35 (KH…
Émulateur
HTTP
WAF
16
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
11600
Chemin / cible
/
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
62%
Risque capteur
Moyen
· 44
Confiance : Confiance 62 % — 3 tag(s) WAF
Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 7_1; Win64; x64) AppleWebKit/559.35 (KHTML, like Gecko) Chrome/55.0.352 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:11600
User-Agent: Mozilla/5.0 (Windows NT 7_1; Win64; x64) AppleWebKit/559.35 (KHTML, like Gec
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:11600 User-Agent: Mozilla/5.0 (Windows NT 7_1; Win64; x64) AppleWebKit/559.35 (KHTML, like Gecko) Chrome/55.0.352 Safari/537.36 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "c404a24aa1faaac708a9956e097762c4bb48452d",
"http_host_hash": "35e516a14e2f3b8bd542afb95e103cc59aa0c964",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 207,
"payload_entropy": 5.382806560843275,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "US",
"dst_port": 11600,
"risk_waf": 72,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2,
"risk_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 44,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "d436be1bd35cb0498cefcedd2c04d9950c5a48c3",
"event_fingerprint": "82f41eca6159140128e4d42da31dd32a681bd7b6",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence": 0.62,
"classification_confidence": 0.62,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"confidence_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 44
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "7e3d88763297ca4502a0d0c79fdf456a",
"payload_hash": "57cde0b3bfe929cb79f8b7b682069a3d",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 11600,
"service": "http",
"service_name": "http",
"risk_score": 44
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:11600\r\nUser-Agent: Mozilla\/5.0 (Windows NT 7_1; Win64; x64) AppleWebKit\/559.35 (KHTML, like Gec",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 7_1; Win64; x64) AppleWebKit\/559.35 (KHTML, like Gecko) Chrome\/55.0.352 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:11600\r\nUser-Agent: Mozilla\/5.0 (Windows NT 7_1; Win64; x64) AppleWebKit\/559.35 (KHTML, like Gecko) Chrome\/55.0.352 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:11600\r\nUser-Agent: Mozilla\/5.0 (Windows NT 7_1; Win64; x64) AppleWebKit\/559.35 (KHTML, like Gec",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 7_1; Win64; x64) AppleWebKit\/559.35 (KHTML, like Gecko) Chrome\/55.0.352 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:11600\r\nUser-Agent: Mozilla\/5.0 (Windows NT 7_1; Win64; x64) AppleWebKit\/559.35 (KHTML, like Gecko) Chrome\/55.0.352 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:11600\r\nUser-Agent: Mozilla\/5.0 (Windows NT 7_1; Win64; x64) AppleWebKit\/559.35 (KHTML, like Gec",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6dcfa714f64bc5845d581d9a271388f24e587b8b",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 7_1; Win64; x64) AppleWebKit\/559.35 (KHTML, like Gecko) Chrome\/55.0.352 Safari\/537.36",
"port": 11600,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:11600\r\nUser-Agent: Mozilla\/5.0 (Windows NT 7_1; Win64; x64) AppleWebKit\/559.35 (KHTML, like Gec",
"attack_vector": "exploit attempt \u00b7 via HTTP:11600 \u00b7 (tentative d'exploit)",
"target_port_label": "11600 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 44\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP",
"confidence_pct": 62,
"confidence_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 44
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 11600,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1190"
],
"tags_summary_labels_fr": [
"MITRE-T1190"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 7_1; Win64; x64) AppleWebKit\/559.35 (KHTML, like Gecko) Chrome\/55.0.352 Safari\/537.36",
"port": 11600,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "exploit attempt \u00b7 via HTTP:11600 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:11600\r\nUser-Agent: Mozilla\/5.0 (Windows NT 7_1; Win64; x64) AppleWebKit\/559.35 (KHTML, like Gec",
"target_port_label": "11600 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "11600"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
]
}
08/06/2026 00:11:23 UTC
TCP
11600 · HTTP
Sonde HTTP
Sonde HTTP · via HTTP:11600 · (sonde / probe) · → /favicon.ico
Moyenne
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1595
TA0007
TA0001
Protocole
GET /favicon.ico UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/favicon.ico
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
11600
Chemin / cible
/favicon.ico
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 40
Confiance : Confiance 95 % — Motif catalogue confirmé
Signaux
Requête favicon.ico
Single Port
Chemin bénin connu
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /favicon.ico HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /favicon.ico HTTP/1.1
Host: 62.3.50.33:11600
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "ico",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "35e516a14e2f3b8bd542afb95e103cc59aa0c964",
"http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 127,
"payload_entropy": 4.901174746029859,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "US",
"dst_port": 11600,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.3,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "b599e133935ab0182918e0b4517251a18cdd6d4d",
"event_fingerprint": "d8640fa1fedca18b3a27e01760156b2637343739",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 94,
"precision_signals": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"kb_rule_ids": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "c66c4c43292ab447703f7a96bc2f0563",
"path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a"
},
"target_context": {
"dst_port": 11600,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:11600\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/favicon.ico",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:11600\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:11600\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/favicon.ico",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:11600\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:11600\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b62e864a4804eb945653e17ac66debc072d1897e",
"protocol_details": {
"http_method": "GET",
"http_path": "\/favicon.ico",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 11600,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:11600\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:11600 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
"target_port_label": "11600 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 11600,
"protocol_emulated": null,
"tags_summary": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"tags_summary_labels_fr": [
"Requ\u00eate favicon.ico",
"Single Port",
"Chemin b\u00e9nin connu"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/favicon.ico",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 11600,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:11600 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
"evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:11600\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"target_port_label": "11600 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "11600"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
],
"behavior_alert_count": 1,
"behavior_priority": 72
}
07/06/2026 20:17:33 UTC
TCP
10596 · HTTP
Sonde HTTP
Sonde HTTP · via HTTP:10596 · (sonde / probe) · → /favicon.ico
Moyenne
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1595
TA0007
TA0001
Protocole
GET /favicon.ico UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/favicon.ico
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
10596
Chemin / cible
/favicon.ico
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 40
Confiance : Confiance 95 % — Motif catalogue confirmé
Signaux
Requête favicon.ico
Single Port
Chemin bénin connu
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /favicon.ico HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /favicon.ico HTTP/1.1
Host: 62.3.50.33:10596
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "ico",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "e8f35b2fd9b5c8748f8c346b306671a0f6d7027a",
"http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 127,
"payload_entropy": 4.937828462817683,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "US",
"dst_port": 10596,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "337a46d0da53af37d7cdc9745e5a998d010cd4a9",
"event_fingerprint": "5427b50ff94081fd72b70e8f3ea449ecbbbcf7a7",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 94,
"precision_signals": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"kb_rule_ids": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "70da059e8f6ce6ba007e85661e25fe09",
"path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a"
},
"target_context": {
"dst_port": 10596,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:10596\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/favicon.ico",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:10596\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:10596\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/favicon.ico",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:10596\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:10596\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5ebedb91805ab66f1f5472cc73acb08b72c6de1f",
"protocol_details": {
"http_method": "GET",
"http_path": "\/favicon.ico",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 10596,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:10596\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:10596 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
"target_port_label": "10596 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 10596,
"protocol_emulated": null,
"tags_summary": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"tags_summary_labels_fr": [
"Requ\u00eate favicon.ico",
"Single Port",
"Chemin b\u00e9nin connu"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/favicon.ico",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 10596,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:10596 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
"evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:10596\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"target_port_label": "10596 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "10596"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
07/06/2026 20:17:33 UTC
TCP
10596 · HTTP
Sonde HTTP
Sonde HTTP · via HTTP:10596 · (sonde / probe) · → /sitemap.xml
Moyenne
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1595
TA0007
TA0001
Protocole
GET /sitemap.xml UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/sitemap.xml
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
10596
Chemin / cible
/sitemap.xml
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 40
Confiance : Confiance 95 % — Motif catalogue confirmé
Signaux
Requête sitemap.xml
Single Port
Chemin bénin connu
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /sitemap.xml HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /sitemap.xml HTTP/1.1
Host: 62.3.50.33:10596
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "xml",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "e8f35b2fd9b5c8748f8c346b306671a0f6d7027a",
"http_target_hash": "aefeebe85207f9638bc792aa32d2470b82e35120",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 127,
"payload_entropy": 4.9810864358359765,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "US",
"dst_port": 10596,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "337a46d0da53af37d7cdc9745e5a998d010cd4a9",
"event_fingerprint": "8a2ece49b77567abaccb2378df51fd86c9fc9614",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 92,
"precision_signals": [
"INT-benign-sitemap",
"INT-single-port",
"INT-benign-path-cap"
],
"kb_rule_ids": [
"INT-benign-sitemap",
"INT-single-port",
"INT-benign-path-cap"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "312f604f7a7689320a0c7fd10c73acda",
"path_pattern_hash": "7efd2a819481844ebcfd47a818831daf"
},
"target_context": {
"dst_port": 10596,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:10596\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/sitemap.xml",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:10596\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:10596\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/sitemap.xml",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:10596\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:10596\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b78ace3eac062e1be1719b07c8031b5916abdbe6",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sitemap.xml",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 10596,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:10596\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:10596 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
"target_port_label": "10596 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 10596,
"protocol_emulated": null,
"tags_summary": [
"INT-benign-sitemap",
"INT-single-port",
"INT-benign-path-cap"
],
"tags_summary_labels_fr": [
"Requ\u00eate sitemap.xml",
"Single Port",
"Chemin b\u00e9nin connu"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/sitemap.xml",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 10596,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:10596 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
"evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:10596\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"target_port_label": "10596 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "10596"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
07/06/2026 20:17:33 UTC
TCP
10596 · HTTP
Sonde HTTP
Sonde HTTP · via HTTP:10596 · (sonde / probe) · → /robots.txt
Moyenne
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1595
TA0007
TA0001
Protocole
GET /robots.txt UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/robots.txt
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
10596
Chemin / cible
/robots.txt
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 40
Confiance : Confiance 95 % — Motif catalogue confirmé
Signaux
Requête robots.txt
Single Port
Chemin bénin connu
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /robots.txt HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /robots.txt HTTP/1.1
Host: 62.3.50.33:10596
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "txt",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "e8f35b2fd9b5c8748f8c346b306671a0f6d7027a",
"http_target_hash": "b7a9adb9fec4116c29da690c45d9a67df535af9d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 126,
"payload_entropy": 4.922334416444921,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "US",
"dst_port": 10596,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "337a46d0da53af37d7cdc9745e5a998d010cd4a9",
"event_fingerprint": "6ee40778b034948a25d7e989b1b750c01d7edfd9",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 94,
"precision_signals": [
"INT-benign-robots",
"INT-single-port",
"INT-benign-path-cap"
],
"kb_rule_ids": [
"INT-benign-robots",
"INT-single-port",
"INT-benign-path-cap"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "032b90bc7cf158de5fb2766ac6718aff",
"path_pattern_hash": "adada1317532a28bebf63fe6edbea3e4"
},
"target_context": {
"dst_port": 10596,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:10596\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:10596\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:10596\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:10596\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:10596\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a67fa4d594e11463bbc28807fd944816e2a1e33b",
"protocol_details": {
"http_method": "GET",
"http_path": "\/robots.txt",
"request_line": "GET \/robots.txt HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 10596,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:10596\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:10596 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/robots.txt",
"target_port_label": "10596 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 10596,
"protocol_emulated": null,
"tags_summary": [
"INT-benign-robots",
"INT-single-port",
"INT-benign-path-cap"
],
"tags_summary_labels_fr": [
"Requ\u00eate robots.txt",
"Single Port",
"Chemin b\u00e9nin connu"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/robots.txt",
"request_line": "GET \/robots.txt HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 10596,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:10596 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/robots.txt",
"evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:10596\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"target_port_label": "10596 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "10596"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
07/06/2026 20:17:32 UTC
TCP
10596 · HTTP
Tentative d'exploit
exploit attempt · via HTTP:10596 · (tentative d'exploit)
Élevée
Moyen · 47
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Windows NT 7_0_1; Win64; x64) AppleWebKit/544.54 (…
Émulateur
HTTP
WAF
16
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
10596
Chemin / cible
/
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
62%
Risque capteur
Moyen
· 47
Confiance : Confiance 62 % — 3 tag(s) WAF
Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 7_0_1; Win64; x64) AppleWebKit/544.54 (KHTML, like Gecko) Chrome/69.0.2607 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:10596
User-Agent: Mozilla/5.0 (Windows NT 7_0_1; Win64; x64) AppleWebKit/544.54 (KHTML, like G
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:10596 User-Agent: Mozilla/5.0 (Windows NT 7_0_1; Win64; x64) AppleWebKit/544.54 (KHTML, like Gecko) Chrome/69.0.2607 Safari/537.36 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "b2e37f152079c3146ccf0002b369809ed65660b8",
"http_host_hash": "e8f35b2fd9b5c8748f8c346b306671a0f6d7027a",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 210,
"payload_entropy": 5.419263069422302,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "US",
"dst_port": 10596,
"risk_waf": 72,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 47,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "e70160d42d57b0bec80b477276c5926d802a7915",
"event_fingerprint": "4c4d3583552f3f7256b64ae82acbf5851c1e3273",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence": 0.62,
"classification_confidence": 0.62,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"confidence_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 47
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "bbc792c998d786275c5c357063cb78b2",
"payload_hash": "c9fc85330b0332ce9c6f8f4093bf1cc8",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 10596,
"service": "http",
"service_name": "http",
"risk_score": 47
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10596\r\nUser-Agent: Mozilla\/5.0 (Windows NT 7_0_1; Win64; x64) AppleWebKit\/544.54 (KHTML, like G",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 7_0_1; Win64; x64) AppleWebKit\/544.54 (KHTML, like Gecko) Chrome\/69.0.2607 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10596\r\nUser-Agent: Mozilla\/5.0 (Windows NT 7_0_1; Win64; x64) AppleWebKit\/544.54 (KHTML, like Gecko) Chrome\/69.0.2607 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10596\r\nUser-Agent: Mozilla\/5.0 (Windows NT 7_0_1; Win64; x64) AppleWebKit\/544.54 (KHTML, like G",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 7_0_1; Win64; x64) AppleWebKit\/544.54 (KHTML, like Gecko) Chrome\/69.0.2607 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10596\r\nUser-Agent: Mozilla\/5.0 (Windows NT 7_0_1; Win64; x64) AppleWebKit\/544.54 (KHTML, like Gecko) Chrome\/69.0.2607 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10596\r\nUser-Agent: Mozilla\/5.0 (Windows NT 7_0_1; Win64; x64) AppleWebKit\/544.54 (KHTML, like G",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "28128b4ac094e7c98e6b60e66896f8296ca12b19",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 7_0_1; Win64; x64) AppleWebKit\/544.54 (KHTML, like Gecko) Chrome\/69.0.2607 Safari\/537.36",
"port": 10596,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10596\r\nUser-Agent: Mozilla\/5.0 (Windows NT 7_0_1; Win64; x64) AppleWebKit\/544.54 (KHTML, like G",
"attack_vector": "exploit attempt \u00b7 via HTTP:10596 \u00b7 (tentative d'exploit)",
"target_port_label": "10596 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP",
"confidence_pct": 62,
"confidence_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 47
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 47,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 10596,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1190"
],
"tags_summary_labels_fr": [
"MITRE-T1190"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 7_0_1; Win64; x64) AppleWebKit\/544.54 (KHTML, like Gecko) Chrome\/69.0.2607 Safari\/537.36",
"port": 10596,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "exploit attempt \u00b7 via HTTP:10596 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10596\r\nUser-Agent: Mozilla\/5.0 (Windows NT 7_0_1; Win64; x64) AppleWebKit\/544.54 (KHTML, like G",
"target_port_label": "10596 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "10596"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
]
}
07/06/2026 18:56:27 UTC
TCP
2796 · HTTP
Sonde HTTP
Sonde HTTP · via HTTP:2796 · (sonde / probe) · → /favicon.ico
Moyenne
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1595
TA0007
TA0001
Protocole
GET /favicon.ico UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/favicon.ico
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
2796
Chemin / cible
/favicon.ico
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 40
Confiance : Confiance 95 % — Motif catalogue confirmé
Signaux
Requête favicon.ico
Single Port
Chemin bénin connu
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /favicon.ico HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /favicon.ico HTTP/1.1
Host: 62.3.50.33:2796
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "ico",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "ab8575cfdd77dbc8643eaacf08f80dc4216aedf5",
"http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 126,
"payload_entropy": 4.954668018993708,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "US",
"dst_port": 2796,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.3,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "7fb144eddcb622cbccb8c43a47e0d17ea1602546",
"event_fingerprint": "e9563f084d553473e6d89af4e8e3689e50e58d7b",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 94,
"precision_signals": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"kb_rule_ids": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "88917ddaab2b9e472837881135979368",
"path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a"
},
"target_context": {
"dst_port": 2796,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2796\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/favicon.ico",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2796\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2796\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/favicon.ico",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2796\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2796\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d9476dfc2c0781ffc9ea57068275a1ab50c92a42",
"protocol_details": {
"http_method": "GET",
"http_path": "\/favicon.ico",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 2796,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2796\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:2796 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
"target_port_label": "2796 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 40\/100 (Moyen) \u2014 MITRE T1595 \u2014 confiance 95 % \u2014 via HTTP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2796,
"protocol_emulated": null,
"tags_summary": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"tags_summary_labels_fr": [
"Requ\u00eate favicon.ico",
"Single Port",
"Chemin b\u00e9nin connu"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/favicon.ico",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 2796,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:2796 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
"evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2796\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"target_port_label": "2796 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2796"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
07/06/2026 18:56:27 UTC
TCP
2796 · HTTP
Sonde HTTP
Sonde HTTP · via HTTP:2796 · (sonde / probe) · → /robots.txt
Moyenne
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1595
TA0007
TA0001
Protocole
GET /robots.txt UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/robots.txt
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
2796
Chemin / cible
/robots.txt
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 40
Confiance : Confiance 95 % — Motif catalogue confirmé
Signaux
Requête robots.txt
Single Port
Chemin bénin connu
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /robots.txt HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /robots.txt HTTP/1.1
Host: 62.3.50.33:2796
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "txt",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "ab8575cfdd77dbc8643eaacf08f80dc4216aedf5",
"http_target_hash": "b7a9adb9fec4116c29da690c45d9a67df535af9d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 125,
"payload_entropy": 4.939276337346148,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "US",
"dst_port": 2796,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.3,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "7fb144eddcb622cbccb8c43a47e0d17ea1602546",
"event_fingerprint": "176d4f69cba9d0bcb873aa5bec16ed085ca8ae02",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 94,
"precision_signals": [
"INT-benign-robots",
"INT-single-port",
"INT-benign-path-cap"
],
"kb_rule_ids": [
"INT-benign-robots",
"INT-single-port",
"INT-benign-path-cap"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "4ebf166eaf4c4741561fbea8adabf5d7",
"path_pattern_hash": "adada1317532a28bebf63fe6edbea3e4"
},
"target_context": {
"dst_port": 2796,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2796\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2796\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2796\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2796\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2796\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6a40932b2b4956bfa5a662d855b13fa3b5790470",
"protocol_details": {
"http_method": "GET",
"http_path": "\/robots.txt",
"request_line": "GET \/robots.txt HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 2796,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2796\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:2796 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/robots.txt",
"target_port_label": "2796 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 40\/100 (Moyen) \u2014 MITRE T1595 \u2014 confiance 95 % \u2014 via HTTP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2796,
"protocol_emulated": null,
"tags_summary": [
"INT-benign-robots",
"INT-single-port",
"INT-benign-path-cap"
],
"tags_summary_labels_fr": [
"Requ\u00eate robots.txt",
"Single Port",
"Chemin b\u00e9nin connu"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/robots.txt",
"request_line": "GET \/robots.txt HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 2796,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:2796 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/robots.txt",
"evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2796\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"target_port_label": "2796 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2796"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
07/06/2026 18:56:27 UTC
TCP
2796 · HTTP
Sonde HTTP
Sonde HTTP · via HTTP:2796 · (sonde / probe) · → /sitemap.xml
Moyenne
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1595
TA0007
TA0001
Protocole
GET /sitemap.xml UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/sitemap.xml
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
2796
Chemin / cible
/sitemap.xml
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 40
Confiance : Confiance 95 % — Motif catalogue confirmé
Signaux
Requête sitemap.xml
Single Port
Chemin bénin connu
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /sitemap.xml HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /sitemap.xml HTTP/1.1
Host: 62.3.50.33:2796
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "xml",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "ab8575cfdd77dbc8643eaacf08f80dc4216aedf5",
"http_target_hash": "aefeebe85207f9638bc792aa32d2470b82e35120",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 126,
"payload_entropy": 4.99826930925818,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "US",
"dst_port": 2796,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.3,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "7fb144eddcb622cbccb8c43a47e0d17ea1602546",
"event_fingerprint": "cfb7f7c9135628866b9186a17edf163e7b0084b0",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 92,
"precision_signals": [
"INT-benign-sitemap",
"INT-single-port",
"INT-benign-path-cap"
],
"kb_rule_ids": [
"INT-benign-sitemap",
"INT-single-port",
"INT-benign-path-cap"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "a3ec0686054f9c53eec2aa76adbc488f",
"path_pattern_hash": "7efd2a819481844ebcfd47a818831daf"
},
"target_context": {
"dst_port": 2796,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:2796\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/sitemap.xml",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:2796\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:2796\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/sitemap.xml",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:2796\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:2796\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "533ef02e9377b85ddc83cb55501917f1b5f23ab6",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sitemap.xml",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 2796,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:2796\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:2796 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
"target_port_label": "2796 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 40\/100 (Moyen) \u2014 MITRE T1595 \u2014 confiance 95 % \u2014 via HTTP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2796,
"protocol_emulated": null,
"tags_summary": [
"INT-benign-sitemap",
"INT-single-port",
"INT-benign-path-cap"
],
"tags_summary_labels_fr": [
"Requ\u00eate sitemap.xml",
"Single Port",
"Chemin b\u00e9nin connu"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/sitemap.xml",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 2796,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:2796 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
"evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:2796\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"target_port_label": "2796 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2796"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
07/06/2026 18:56:26 UTC
TCP
2796 · HTTP
Tentative d'exploit
exploit attempt · via HTTP:2796 · (tentative d'exploit)
Élevée
Moyen · 44
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 9_2) AppleWebKit/547.43 …
Émulateur
HTTP
WAF
16
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
2796
Chemin / cible
/
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
62%
Risque capteur
Moyen
· 44
Confiance : Confiance 62 % — 3 tag(s) WAF
Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 9_2) AppleWebKit/547.43 (KHTML, like Gecko) Chrome/88.0.2670 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:2796
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 9_2) AppleWebKit/547.43 (KHTML, like G
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:2796 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 9_2) AppleWebKit/547.43 (KHTML, like Gecko) Chrome/88.0.2670 Safari/537.36 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "d54a36afe9fc138f7de4be45b70685882a54a549",
"http_host_hash": "ab8575cfdd77dbc8643eaacf08f80dc4216aedf5",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 210,
"payload_entropy": 5.411339621044695,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "US",
"dst_port": 2796,
"risk_waf": 72,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2,
"risk_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 44,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "657000687d3e571aaa34badee35e7a7b4b67e2ec",
"event_fingerprint": "c3274cf148278807353e23603af418079f8360c1",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence": 0.62,
"classification_confidence": 0.62,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"confidence_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 44
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "6cd29eedde4b42f6bcf8a9aa88d87ac1",
"payload_hash": "ef63a50c996ef2dc026df05522e22db6",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 2796,
"service": "http",
"service_name": "http",
"risk_score": 44
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2796\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_2) AppleWebKit\/547.43 (KHTML, like G",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_2) AppleWebKit\/547.43 (KHTML, like Gecko) Chrome\/88.0.2670 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2796\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_2) AppleWebKit\/547.43 (KHTML, like Gecko) Chrome\/88.0.2670 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2796\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_2) AppleWebKit\/547.43 (KHTML, like G",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_2) AppleWebKit\/547.43 (KHTML, like Gecko) Chrome\/88.0.2670 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2796\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_2) AppleWebKit\/547.43 (KHTML, like Gecko) Chrome\/88.0.2670 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2796\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_2) AppleWebKit\/547.43 (KHTML, like G",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "917015abe6ee71fa4a3958c0434efea02a49211d",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_2) AppleWebKit\/547.43 (KHTML, like Gecko) Chrome\/88.0.2670 Safari\/537.36",
"port": 2796,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2796\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_2) AppleWebKit\/547.43 (KHTML, like G",
"attack_vector": "exploit attempt \u00b7 via HTTP:2796 \u00b7 (tentative d'exploit)",
"target_port_label": "2796 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 44\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP",
"confidence_pct": 62,
"confidence_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 44
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2796,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1190"
],
"tags_summary_labels_fr": [
"MITRE-T1190"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_2) AppleWebKit\/547.43 (KHTML, like Gecko) Chrome\/88.0.2670 Safari\/537.36",
"port": 2796,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "exploit attempt \u00b7 via HTTP:2796 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2796\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_2) AppleWebKit\/547.43 (KHTML, like G",
"target_port_label": "2796 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2796"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
]
}
07/06/2026 17:25:23 UTC
TCP
10646 · HTTP
Sonde HTTP
Sonde HTTP · via HTTP:10646 · (sonde / probe) · → /sitemap.xml
Moyenne
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1595
TA0007
TA0001
Protocole
GET /sitemap.xml UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/sitemap.xml
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
10646
Chemin / cible
/sitemap.xml
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 40
Confiance : Confiance 95 % — Motif catalogue confirmé
Signaux
Requête sitemap.xml
Single Port
Chemin bénin connu
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /sitemap.xml HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /sitemap.xml HTTP/1.1
Host: 62.3.50.33:10646
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "xml",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "3a48a6811bc9c82bbb6c2e6157bb32f3d84b30fd",
"http_target_hash": "aefeebe85207f9638bc792aa32d2470b82e35120",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 127,
"payload_entropy": 4.975142439755949,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "US",
"dst_port": 10646,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.4,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "346011ad2d91dbbe2c09f863925f3b7e7faf1332",
"event_fingerprint": "a4517ec44053808659d66137100daf47155c6759",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 100,
"precision_signals": [
"INT-benign-sitemap",
"INT-single-port",
"INT-benign-path-cap"
],
"kb_rule_ids": [
"INT-benign-sitemap",
"INT-single-port",
"INT-benign-path-cap"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "9cb7f29d2bc6ac0e6a9667170c13d34e",
"path_pattern_hash": "7efd2a819481844ebcfd47a818831daf"
},
"target_context": {
"dst_port": 10646,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:10646\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/sitemap.xml",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:10646\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:10646\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/sitemap.xml",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:10646\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:10646\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "89e204d15e126ea68529804e3b9b08a3dd659932",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sitemap.xml",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 10646,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:10646\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:10646 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
"target_port_label": "10646 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 10646,
"protocol_emulated": null,
"tags_summary": [
"INT-benign-sitemap",
"INT-single-port",
"INT-benign-path-cap"
],
"tags_summary_labels_fr": [
"Requ\u00eate sitemap.xml",
"Single Port",
"Chemin b\u00e9nin connu"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/sitemap.xml",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 10646,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:10646 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
"evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:10646\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"target_port_label": "10646 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "10646"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
07/06/2026 17:25:23 UTC
TCP
10646 · HTTP
Sonde HTTP
Sonde HTTP · via HTTP:10646 · (sonde / probe) · → /robots.txt
Moyenne
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1595
TA0007
TA0001
Protocole
GET /robots.txt UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/robots.txt
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
10646
Chemin / cible
/robots.txt
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 40
Confiance : Confiance 95 % — Motif catalogue confirmé
Signaux
Requête robots.txt
Single Port
Chemin bénin connu
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /robots.txt HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /robots.txt HTTP/1.1
Host: 62.3.50.33:10646
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "txt",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "3a48a6811bc9c82bbb6c2e6157bb32f3d84b30fd",
"http_target_hash": "b7a9adb9fec4116c29da690c45d9a67df535af9d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 126,
"payload_entropy": 4.91634324579283,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "US",
"dst_port": 10646,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.4,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "346011ad2d91dbbe2c09f863925f3b7e7faf1332",
"event_fingerprint": "1b81131b912d0ff7ddc6845d1295800aec80edcc",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 102,
"precision_signals": [
"INT-benign-robots",
"INT-single-port",
"INT-benign-path-cap"
],
"kb_rule_ids": [
"INT-benign-robots",
"INT-single-port",
"INT-benign-path-cap"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "cf42fa94607d22a1df154b4430627216",
"path_pattern_hash": "adada1317532a28bebf63fe6edbea3e4"
},
"target_context": {
"dst_port": 10646,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:10646\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:10646\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:10646\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:10646\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:10646\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "be7671061d0dab27fc646a4a5abc9c7daf4e8014",
"protocol_details": {
"http_method": "GET",
"http_path": "\/robots.txt",
"request_line": "GET \/robots.txt HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 10646,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:10646\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:10646 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/robots.txt",
"target_port_label": "10646 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 10646,
"protocol_emulated": null,
"tags_summary": [
"INT-benign-robots",
"INT-single-port",
"INT-benign-path-cap"
],
"tags_summary_labels_fr": [
"Requ\u00eate robots.txt",
"Single Port",
"Chemin b\u00e9nin connu"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/robots.txt",
"request_line": "GET \/robots.txt HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 10646,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:10646 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/robots.txt",
"evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:10646\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"target_port_label": "10646 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "10646"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
07/06/2026 17:25:22 UTC
TCP
10646 · HTTP
Tentative d'exploit
exploit attempt · via HTTP:10646 · (tentative d'exploit)
Élevée
Moyen · 45
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 8_0) AppleWebKit/537.45 …
Émulateur
HTTP
WAF
16
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
10646
Chemin / cible
/
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
62%
Risque capteur
Moyen
· 45
Confiance : Confiance 62 % — 3 tag(s) WAF
Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 8_0) AppleWebKit/537.45 (KHTML, like Gecko) Chrome/93.0.792 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:10646
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 8_0) AppleWebKit/537.45 (KHTML, like
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:10646 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 8_0) AppleWebKit/537.45 (KHTML, like Gecko) Chrome/93.0.792 Safari/537.36 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "c6d8ac5865e4f1c8260142b3170e1f713cfae307",
"http_host_hash": "3a48a6811bc9c82bbb6c2e6157bb32f3d84b30fd",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 210,
"payload_entropy": 5.397669309600521,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "US",
"dst_port": 10646,
"risk_waf": 72,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.1,
"risk_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7618c59a88a14f5c83bac7a8af697734647eff1d",
"event_fingerprint": "0134ad78f777926164e4469fe6a80809256c1994",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence": 0.62,
"classification_confidence": 0.62,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"confidence_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2d8465daf0951d456ca717b3c83cbc48",
"payload_hash": "33a508ab1722c7c54a44657b02598911",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 10646,
"service": "http",
"service_name": "http",
"risk_score": 45
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10646\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_0) AppleWebKit\/537.45 (KHTML, like ",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_0) AppleWebKit\/537.45 (KHTML, like Gecko) Chrome\/93.0.792 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10646\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_0) AppleWebKit\/537.45 (KHTML, like Gecko) Chrome\/93.0.792 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10646\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_0) AppleWebKit\/537.45 (KHTML, like",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_0) AppleWebKit\/537.45 (KHTML, like Gecko) Chrome\/93.0.792 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10646\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_0) AppleWebKit\/537.45 (KHTML, like Gecko) Chrome\/93.0.792 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10646\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_0) AppleWebKit\/537.45 (KHTML, like",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9b8fe218ce53e877be9776da4a67a3f0979d7e13",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_0) AppleWebKit\/537.45 (KHTML, like Gecko) Chrome\/93.0.792 Safari\/537.36",
"port": 10646,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10646\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_0) AppleWebKit\/537.45 (KHTML, like",
"attack_vector": "exploit attempt \u00b7 via HTTP:10646 \u00b7 (tentative d'exploit)",
"target_port_label": "10646 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence_pct": 62,
"confidence_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 10646,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1190"
],
"tags_summary_labels_fr": [
"MITRE-T1190"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_0) AppleWebKit\/537.45 (KHTML, like Gecko) Chrome\/93.0.792 Safari\/537.36",
"port": 10646,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "exploit attempt \u00b7 via HTTP:10646 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10646\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_0) AppleWebKit\/537.45 (KHTML, like",
"target_port_label": "10646 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "10646"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
]
}
07/06/2026 17:25:22 UTC
TCP
10646 · HTTP
Sonde HTTP
Sonde HTTP · via HTTP:10646 · (sonde / probe) · → /favicon.ico
Moyenne
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1595
TA0007
TA0001
Protocole
GET /favicon.ico UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/favicon.ico
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
10646
Chemin / cible
/favicon.ico
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 40
Confiance : Confiance 95 % — Motif catalogue confirmé
Signaux
Requête favicon.ico
Single Port
Chemin bénin connu
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /favicon.ico HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /favicon.ico HTTP/1.1
Host: 62.3.50.33:10646
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "ico",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "3a48a6811bc9c82bbb6c2e6157bb32f3d84b30fd",
"http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 127,
"payload_entropy": 4.931884466737656,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "US",
"dst_port": 10646,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.4,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "346011ad2d91dbbe2c09f863925f3b7e7faf1332",
"event_fingerprint": "c5f516ef4bc0963d28ea54a334b7e2e1b8d2477d",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 102,
"precision_signals": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"kb_rule_ids": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "be8b012e6ca06c5e00d6fe81224992cb",
"path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a"
},
"target_context": {
"dst_port": 10646,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:10646\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/favicon.ico",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:10646\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:10646\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/favicon.ico",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:10646\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:10646\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "56e77c6bac6e85e19beaca9ec0495cef78dbef4b",
"protocol_details": {
"http_method": "GET",
"http_path": "\/favicon.ico",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 10646,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:10646\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:10646 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
"target_port_label": "10646 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 10646,
"protocol_emulated": null,
"tags_summary": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"tags_summary_labels_fr": [
"Requ\u00eate favicon.ico",
"Single Port",
"Chemin b\u00e9nin connu"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/favicon.ico",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 10646,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:10646 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
"evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:10646\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"target_port_label": "10646 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "10646"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
07/06/2026 16:08:33 UTC
TCP
9639 · HTTP
Sonde HTTP
Sonde HTTP · via HTTP:9639 · (sonde / probe) · → /favicon.ico
Moyenne
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1595
TA0007
TA0001
Protocole
GET /favicon.ico UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/favicon.ico
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9639
Chemin / cible
/favicon.ico
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 40
Confiance : Confiance 95 % — Motif catalogue confirmé
Signaux
Requête favicon.ico
Single Port
Chemin bénin connu
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /favicon.ico HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /favicon.ico HTTP/1.1
Host: 62.3.50.33:9639
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "ico",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "231bac716483595ee77f9621353be9b318b986bd",
"http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 126,
"payload_entropy": 4.928913157899767,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "US",
"dst_port": 9639,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "ffc00f61c233977e100ae69659687fd67aa27cb4",
"event_fingerprint": "f4e7a9f31a941c9b8cd4d6d09c38291a9c7fd900",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 102,
"precision_signals": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"kb_rule_ids": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "c38e9bddb3b22afb725291f3cf47ad3e",
"path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a"
},
"target_context": {
"dst_port": 9639,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:9639\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/favicon.ico",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:9639\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:9639\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/favicon.ico",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:9639\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:9639\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "93a0b807026cb623648f12ab54c4488e81d4ae07",
"protocol_details": {
"http_method": "GET",
"http_path": "\/favicon.ico",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 9639,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:9639\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:9639 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
"target_port_label": "9639 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9639,
"protocol_emulated": null,
"tags_summary": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"tags_summary_labels_fr": [
"Requ\u00eate favicon.ico",
"Single Port",
"Chemin b\u00e9nin connu"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/favicon.ico",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 9639,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:9639 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
"evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:9639\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"target_port_label": "9639 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9639"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
07/06/2026 16:08:33 UTC
TCP
9639 · HTTP
Sonde HTTP
Sonde HTTP · via HTTP:9639 · (sonde / probe) · → /sitemap.xml
Moyenne
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1595
TA0007
TA0001
Protocole
GET /sitemap.xml UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/sitemap.xml
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9639
Chemin / cible
/sitemap.xml
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 40
Confiance : Confiance 95 % — Motif catalogue confirmé
Signaux
Requête sitemap.xml
Single Port
Chemin bénin connu
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /sitemap.xml HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /sitemap.xml HTTP/1.1
Host: 62.3.50.33:9639
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "xml",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "231bac716483595ee77f9621353be9b318b986bd",
"http_target_hash": "aefeebe85207f9638bc792aa32d2470b82e35120",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 126,
"payload_entropy": 4.9725144481642385,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "US",
"dst_port": 9639,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "ffc00f61c233977e100ae69659687fd67aa27cb4",
"event_fingerprint": "bca7226355cd639af1bb02303a020de0cc0ff7ec",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 100,
"precision_signals": [
"INT-benign-sitemap",
"INT-single-port",
"INT-benign-path-cap"
],
"kb_rule_ids": [
"INT-benign-sitemap",
"INT-single-port",
"INT-benign-path-cap"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "43659d6fa16aea33d52b38dbdf3d9a0f",
"path_pattern_hash": "7efd2a819481844ebcfd47a818831daf"
},
"target_context": {
"dst_port": 9639,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:9639\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/sitemap.xml",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:9639\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:9639\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/sitemap.xml",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:9639\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:9639\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "699a5d312276291bd64c688d8070090209608738",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sitemap.xml",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 9639,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:9639\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:9639 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
"target_port_label": "9639 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9639,
"protocol_emulated": null,
"tags_summary": [
"INT-benign-sitemap",
"INT-single-port",
"INT-benign-path-cap"
],
"tags_summary_labels_fr": [
"Requ\u00eate sitemap.xml",
"Single Port",
"Chemin b\u00e9nin connu"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/sitemap.xml",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 9639,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:9639 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
"evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:9639\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"target_port_label": "9639 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9639"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
07/06/2026 16:08:33 UTC
TCP
9639 · HTTP
Sonde HTTP
Sonde HTTP · via HTTP:9639 · (sonde / probe) · → /robots.txt
Moyenne
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1595
TA0007
TA0001
Protocole
GET /robots.txt UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/robots.txt
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9639
Chemin / cible
/robots.txt
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 40
Confiance : Confiance 95 % — Motif catalogue confirmé
Signaux
Requête robots.txt
Single Port
Chemin bénin connu
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /robots.txt HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /robots.txt HTTP/1.1
Host: 62.3.50.33:9639
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "txt",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "231bac716483595ee77f9621353be9b318b986bd",
"http_target_hash": "b7a9adb9fec4116c29da690c45d9a67df535af9d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 125,
"payload_entropy": 4.913315437363455,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "US",
"dst_port": 9639,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "ffc00f61c233977e100ae69659687fd67aa27cb4",
"event_fingerprint": "6bf0136a86e1c416e78ba188123a4e2d373e76f2",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 102,
"precision_signals": [
"INT-benign-robots",
"INT-single-port",
"INT-benign-path-cap"
],
"kb_rule_ids": [
"INT-benign-robots",
"INT-single-port",
"INT-benign-path-cap"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "53448a405485536a9b92678f28befc3d",
"path_pattern_hash": "adada1317532a28bebf63fe6edbea3e4"
},
"target_context": {
"dst_port": 9639,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:9639\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:9639\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:9639\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:9639\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:9639\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "74d93cc46734f3ac514e8f61d2ac28516a9650f6",
"protocol_details": {
"http_method": "GET",
"http_path": "\/robots.txt",
"request_line": "GET \/robots.txt HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 9639,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:9639\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:9639 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/robots.txt",
"target_port_label": "9639 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9639,
"protocol_emulated": null,
"tags_summary": [
"INT-benign-robots",
"INT-single-port",
"INT-benign-path-cap"
],
"tags_summary_labels_fr": [
"Requ\u00eate robots.txt",
"Single Port",
"Chemin b\u00e9nin connu"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/robots.txt",
"request_line": "GET \/robots.txt HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 9639,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:9639 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/robots.txt",
"evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:9639\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"target_port_label": "9639 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9639"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
07/06/2026 16:08:32 UTC
TCP
9639 · HTTP
Tentative d'exploit
exploit attempt · via HTTP:9639 · (tentative d'exploit)
Élevée
Moyen · 48
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Windows NT 7_1_2; Win64; x64) AppleWebKit/534.48 (…
Émulateur
HTTP
WAF
16
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9639
Chemin / cible
/
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
62%
Risque capteur
Moyen
· 48
Confiance : Confiance 62 % — 3 tag(s) WAF
Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 7_1_2; Win64; x64) AppleWebKit/534.48 (KHTML, like Gecko) Chrome/87.0.182 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:9639
User-Agent: Mozilla/5.0 (Windows NT 7_1_2; Win64; x64) AppleWebKit/534.48 (KHTML, like Ge
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:9639 User-Agent: Mozilla/5.0 (Windows NT 7_1_2; Win64; x64) AppleWebKit/534.48 (KHTML, like Gecko) Chrome/87.0.182 Safari/537.36 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "2414a130e6dc302119c52d8c573d4d140aceb851",
"http_host_hash": "231bac716483595ee77f9621353be9b318b986bd",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 208,
"payload_entropy": 5.452450361628585,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "US",
"dst_port": 9639,
"risk_waf": 72,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 48,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "998628d69866cfced2cc9754d1c0f00f5fb93646",
"event_fingerprint": "8fde3baf015ddcc41180f61d01f79b091494f8b8",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence": 0.62,
"classification_confidence": 0.62,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"confidence_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 48
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "0ed260448d6a9bb3568e78eb30f2ff73",
"payload_hash": "c6d721927d684bccd4ad29e448ce12ab",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 9639,
"service": "http",
"service_name": "http",
"risk_score": 48
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9639\r\nUser-Agent: Mozilla\/5.0 (Windows NT 7_1_2; Win64; x64) AppleWebKit\/534.48 (KHTML, like Ge",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 7_1_2; Win64; x64) AppleWebKit\/534.48 (KHTML, like Gecko) Chrome\/87.0.182 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9639\r\nUser-Agent: Mozilla\/5.0 (Windows NT 7_1_2; Win64; x64) AppleWebKit\/534.48 (KHTML, like Gecko) Chrome\/87.0.182 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9639\r\nUser-Agent: Mozilla\/5.0 (Windows NT 7_1_2; Win64; x64) AppleWebKit\/534.48 (KHTML, like Ge",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 7_1_2; Win64; x64) AppleWebKit\/534.48 (KHTML, like Gecko) Chrome\/87.0.182 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9639\r\nUser-Agent: Mozilla\/5.0 (Windows NT 7_1_2; Win64; x64) AppleWebKit\/534.48 (KHTML, like Gecko) Chrome\/87.0.182 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9639\r\nUser-Agent: Mozilla\/5.0 (Windows NT 7_1_2; Win64; x64) AppleWebKit\/534.48 (KHTML, like Ge",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3e2bd11fcdb12eded18e744a8a0cc8ce2562c0a8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 7_1_2; Win64; x64) AppleWebKit\/534.48 (KHTML, like Gecko) Chrome\/87.0.182 Safari\/537.36",
"port": 9639,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9639\r\nUser-Agent: Mozilla\/5.0 (Windows NT 7_1_2; Win64; x64) AppleWebKit\/534.48 (KHTML, like Ge",
"attack_vector": "exploit attempt \u00b7 via HTTP:9639 \u00b7 (tentative d'exploit)",
"target_port_label": "9639 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence_pct": 62,
"confidence_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 48
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 48,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9639,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1190"
],
"tags_summary_labels_fr": [
"MITRE-T1190"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 7_1_2; Win64; x64) AppleWebKit\/534.48 (KHTML, like Gecko) Chrome\/87.0.182 Safari\/537.36",
"port": 9639,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "exploit attempt \u00b7 via HTTP:9639 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9639\r\nUser-Agent: Mozilla\/5.0 (Windows NT 7_1_2; Win64; x64) AppleWebKit\/534.48 (KHTML, like Ge",
"target_port_label": "9639 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9639"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
]
}
07/06/2026 11:52:49 UTC
TCP
9837 · HTTP
Sonde HTTP
Moyenne
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1595
TA0007
TA0001
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/favicon.ico
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9837
Chemin / cible
/favicon.ico
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 40
Signaux
Requête favicon.ico
Single Port
Chemin bénin connu
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /favicon.ico HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /favicon.ico HTTP/1.1
Host: 62.3.50.33:9837
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "ico",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "e974287bb831661e685629f7ea31eb73b328e09d",
"http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 126,
"payload_entropy": 4.960659189645799,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "US",
"dst_port": 9837,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "0682911ec161de36fa2e753cc8d63fa8eef6e72f",
"event_fingerprint": "f8028d3571613b9bb5004d59b979e3d791aa125f",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 102,
"precision_signals": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"kb_rule_ids": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "86b228fd2767eec1acae8e0fa34865d6",
"path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a"
},
"target_context": {
"dst_port": 9837,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:9837\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/favicon.ico",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:9837\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:9837\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/favicon.ico",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:9837\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:9837\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e32741a7e6b72c62bf05246028e8c616ea7c8dd7",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9837,
"protocol_emulated": null,
"tags_summary": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"tags_summary_labels_fr": [
"Requ\u00eate favicon.ico",
"Single Port",
"Chemin b\u00e9nin connu"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9837"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
07/06/2026 11:52:49 UTC
TCP
9837 · HTTP
Sonde HTTP
Moyenne
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1595
TA0007
TA0001
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/sitemap.xml
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9837
Chemin / cible
/sitemap.xml
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 40
Signaux
Requête sitemap.xml
Single Port
Chemin bénin connu
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /sitemap.xml HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /sitemap.xml HTTP/1.1
Host: 62.3.50.33:9837
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "xml",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "e974287bb831661e685629f7ea31eb73b328e09d",
"http_target_hash": "aefeebe85207f9638bc792aa32d2470b82e35120",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 126,
"payload_entropy": 5.004260479910271,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "US",
"dst_port": 9837,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "0682911ec161de36fa2e753cc8d63fa8eef6e72f",
"event_fingerprint": "1dcbbd790ba5c8500239d2255919fc51b8ec0944",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 100,
"precision_signals": [
"INT-benign-sitemap",
"INT-single-port",
"INT-benign-path-cap"
],
"kb_rule_ids": [
"INT-benign-sitemap",
"INT-single-port",
"INT-benign-path-cap"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "d1fbea516cd16635e06c00600c00c5b9",
"path_pattern_hash": "7efd2a819481844ebcfd47a818831daf"
},
"target_context": {
"dst_port": 9837,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:9837\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/sitemap.xml",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:9837\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:9837\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/sitemap.xml",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:9837\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:9837\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "59a486134194e807da331068b28769e039e135d4",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9837,
"protocol_emulated": null,
"tags_summary": [
"INT-benign-sitemap",
"INT-single-port",
"INT-benign-path-cap"
],
"tags_summary_labels_fr": [
"Requ\u00eate sitemap.xml",
"Single Port",
"Chemin b\u00e9nin connu"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9837"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
07/06/2026 11:52:49 UTC
TCP
9837 · HTTP
Sonde HTTP
Moyenne
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1595
TA0007
TA0001
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/robots.txt
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9837
Chemin / cible
/robots.txt
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 40
Signaux
Requête robots.txt
Single Port
Chemin bénin connu
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /robots.txt HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /robots.txt HTTP/1.1
Host: 62.3.50.33:9837
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "txt",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "e974287bb831661e685629f7ea31eb73b328e09d",
"http_target_hash": "b7a9adb9fec4116c29da690c45d9a67df535af9d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 125,
"payload_entropy": 4.945315437363456,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "US",
"dst_port": 9837,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "0682911ec161de36fa2e753cc8d63fa8eef6e72f",
"event_fingerprint": "fe33979eb468db23fc4a846ca1aeb726fd072e0a",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 102,
"precision_signals": [
"INT-benign-robots",
"INT-single-port",
"INT-benign-path-cap"
],
"kb_rule_ids": [
"INT-benign-robots",
"INT-single-port",
"INT-benign-path-cap"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "2f2b3db2cfb5269cdd9ee6f0e42540f8",
"path_pattern_hash": "adada1317532a28bebf63fe6edbea3e4"
},
"target_context": {
"dst_port": 9837,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:9837\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:9837\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:9837\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:9837\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:9837\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "18bff4c4abfa368af184124419ddfd97ebcdb1a8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9837,
"protocol_emulated": null,
"tags_summary": [
"INT-benign-robots",
"INT-single-port",
"INT-benign-path-cap"
],
"tags_summary_labels_fr": [
"Requ\u00eate robots.txt",
"Single Port",
"Chemin b\u00e9nin connu"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9837"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
07/06/2026 11:52:47 UTC
TCP
9837 · HTTP
Tentative d'exploit
Élevée
Moyen · 45
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
WAF
16
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9837
Chemin / cible
/
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
62%
Risque capteur
Moyen
· 45
Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 9_2) AppleWebKit/601.36 (KHTML, like Gecko) Chrome/104.0.1035 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:9837
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 9_2) AppleWebKit/601.36 (KHTML, like G
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:9837 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 9_2) AppleWebKit/601.36 (KHTML, like Gecko) Chrome/104.0.1035 Safari/537.36 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "60fc347745aec654e166a90c9ccb8a3704a8ea1c",
"http_host_hash": "e974287bb831661e685629f7ea31eb73b328e09d",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 211,
"payload_entropy": 5.383564218257256,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "US",
"dst_port": 9837,
"risk_waf": 72,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a9671bbebaa2d29638e9f118f117de1f42dc4b4d",
"event_fingerprint": "c1194ad47b3982a6f76e23b7ce69d8987fbbb32a",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence": 0.62,
"classification_confidence": 0.62,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"confidence_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "69b2c6c7cda4a75845e7cb0685953fe9",
"payload_hash": "24de692e2ea8e142eba4055885bddb48",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 9837,
"service": "http",
"service_name": "http",
"risk_score": 45
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9837\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_2) AppleWebKit\/601.36 (KHTML, like G",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_2) AppleWebKit\/601.36 (KHTML, like Gecko) Chrome\/104.0.1035 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9837\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_2) AppleWebKit\/601.36 (KHTML, like Gecko) Chrome\/104.0.1035 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9837\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_2) AppleWebKit\/601.36 (KHTML, like G",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_2) AppleWebKit\/601.36 (KHTML, like Gecko) Chrome\/104.0.1035 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9837\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_2) AppleWebKit\/601.36 (KHTML, like Gecko) Chrome\/104.0.1035 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9837\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_2) AppleWebKit\/601.36 (KHTML, like G",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5a9ae313c7c022427b2d3e45cfe8d49687b687a7",
"site_display": {
"classification": null,
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence_pct": 62,
"confidence_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9837,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1190"
],
"tags_summary_labels_fr": [
"MITRE-T1190"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9837"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
]
}