Détails IP 165.232.120.46

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

Type « imap_bruteforce » (signaux protocolaires) · confiance 95%

Confiance 95 % — Score WAF 8

Comparaison ASN / FAI

ASN 14061 · 165.232.112.0/20 · ARIN — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 5 événements sur la période pour cette IP.

209.38.131.131 Sonde IEC 104 (SCADA) 23/07/2026 04:31 UTC
164.92.114.247 Sonde port 23/07/2026 04:30 UTC
146.190.153.30 Sonde port 23/07/2026 04:29 UTC
24.199.126.56 Cross-site scripting 23/07/2026 04:28 UTC
143.198.238.87 Cross-site scripting 23/07/2026 04:28 UTC
143.198.150.150 Sonde port 23/07/2026 04:26 UTC
209.38.70.156 Sonde port 23/07/2026 04:25 UTC
159.89.124.112 Sonde port 23/07/2026 04:25 UTC

IPs apparentées

Même FAI DigitalOcean, LLC — corrélation indicative.

209.38.131.131 Sonde IEC 104 (SCADA)
164.92.114.247 Sonde port
146.190.153.30 Sonde port
24.199.126.56 Cross-site scripting
143.198.238.87 Cross-site scripting

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

CASSANDRA TCP 2 INFLUXDB TCP 1 SAP Diag TCP 1 SMB TCP 1

CASSANDRA

2

INFLUXDB

1

SAP Diag

1

SMB

1

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

De

À

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Chronologie des événements

5 événement(s) — page 1/1

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
22/07/2026 17:45:11 UTC	TCP	445 · SMB	smb	imap bruteforce imap bruteforce · via SMB:445 · (sonde / probe)	Élevée	Moyen · 41
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1110 TA0007 TA0001 Protocole Émulateur SMB WAF — Recommandation Surveiller Tags http_get_probe imap_probe net_smb_probe smb_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 445 Chemin / cible — Service SMB Payload GET /cgi-bin/authLogin.cgi HTTP/1.1 Host: 62.3.50.33:445 User-Agent: Go-http-client/1.1 Connection: close Pourquoi cette classification : Type « imap_bruteforce » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 41 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux Email Imap Login Technique MITRE T1110 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /cgi-bin/authLogin.cgi HTTP/1.1 Host: 62.3.50.33:445 User-Agent: Go-http-client/1.1 Connection: close Meta JSON brut { "protocol_emulated": true, "emulator_response": "00000048", "emulator_response_len": 4, "bytes_in": 112, "payload_entropy": 4.931058861339195, "port_category": "well_known", "org": "DigitalOcean, LLC", "service": "smb", "app_proto": "smb", "asn": 14061, "country": "DE", "dst_port": 445, "risk_waf": 8, "risk_classification": 66, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 46, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 66, "behavior": 0, "geo": 40, "protocol": 46, "novelty": 15 }, "risk_score": 41, "tag_count": 4, "anomaly_count": 0, "campaign_key": "ce04a850f3e420575696d586c8dbfb4a1009c70e", "event_fingerprint": "c2dcd725f3d49cc7233ad16d1772dcd2f3d0439d", "classification_reason": "Type \u00ab imap_bruteforce \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 76, "precision_signals": [ "INT-EMAIL-imap-login" ], "kb_rule_ids": [ "INT-EMAIL-imap-login" ], "confidence_breakdown": { "waf": 8, "classification": 66, "behavior": 0, "geo": 40, "protocol": 46, "novelty": 15, "risk_score": 41 }, "named_classification_skipped": false, "service_name": "smb", "risk_confidence_factor": 95, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "DE", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "6572e4c80df839d79eb51384b33fd3e3", "path_pattern_hash": "d01bbf3f52d5029936b2dffb0f5e856f" }, "target_context": { "dst_port": 445, "service": "smb", "service_name": "smb", "risk_score": 41 }, "payload_preview": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:445\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n", "request_sample": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:445\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:445\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close", "evidence": { "request_sample": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:445\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:445\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close", "classification_reason": "Type \u00ab imap_bruteforce \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1110" ], "mitre": "T1110", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "25e8c4e66c138f9384152d3b8b4883fb8f6b5a42", "protocol_details": { "payload_preview": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:445\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close", "port": 445, "service": "smb", "service_label_fr": "SMB" }, "evidence_snippet": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:445\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close", "attack_vector": "imap bruteforce \u00b7 via SMB:445 \u00b7 (sonde \/ probe)", "target_port_label": "445 \u00b7 SMB", "emulator_service": "smb", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab imap_bruteforce \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab imap_bruteforce \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 41\/100", "confidence_pct": 95, "confidence_breakdown": { "waf": 8, "classification": 66, "behavior": 0, "geo": 40, "protocol": 46, "novelty": 15, "risk_score": 41 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 41, "risk_label": "Moyen", "service_name": "smb", "service_label_fr": "SMB", "dst_port": 445, "protocol_emulated": true, "tags_summary": [ "INT-EMAIL-imap-login" ], "tags_summary_labels_fr": [ "Email Imap Login" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1110", "mitre_technique": "T1110", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-smb", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:445\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close", "port": 445, "service": "smb", "service_label_fr": "SMB" }, "attack_vector": "imap bruteforce \u00b7 via SMB:445 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:445\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close", "target_port_label": "445 \u00b7 SMB", "emulator_service": "smb", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "smb", "service_banner": "honeypot-smb", "service_os": "linux", "dst_port": "445" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_get_probe", "imap_probe", "net_smb_probe", "smb_emulated" ], "asn_dc_heuristic": true }
22/07/2026 10:33:32 UTC	TCP	18789 · SAP Diag	sap-diag	Sonde SAP Diag/GUI Sonde SAP Diag/GUI · via SAP Diag:18789 · (sonde / probe)	Élevée	Faible · 24
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur SAP-DIAG WAF — Recommandation Surveiller Tags http_get_probe net_sap_diag_probe sap_diag_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 18789 Chemin / cible — Service SAP Diag Payload GET /query?q=SHOW+DIAGNOSTICS HTTP/1.1 Host: 62.3.50.33:18789 User-Agent: Go-http-client/1.1 Connection: close Pourquoi cette classification : Connexion SAP Diag/GUI · confiance 0% Confiance classification 0% Risque capteur Faible · 24 Confiance : Confiance 0 % — 3 signal(aux) capteur Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /query?q=SHOW+DIAGNOSTICS HTTP/1.1 Host: 62.3.50.33:18789 User-Agent: Go-http-client/1.1 Connection: close Meta JSON brut { "bytes_in": 117, "payload_entropy": 5.294927682429393, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "sap-diag", "app_proto": "sap-diag", "asn": 14061, "country": "DE", "dst_port": 18789, "risk_waf": 8, "risk_classification": 62, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 48, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.5, "risk_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 40, "protocol": 48, "novelty": 15 }, "risk_score": 24, "tag_count": 3, "anomaly_count": 0, "campaign_key": "93c35b709cd1da9ade41b5cd30820c9cd806f8f6", "event_fingerprint": "126c212c6be954ce59820946d6b66065dfe19769", "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 40, "protocol": 48, "novelty": 15, "risk_score": 24 }, "named_classification_skipped": false, "service_name": "sap-diag", "risk_confidence_factor": 0, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "DE", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "246eab19882625b9ecad06dd168ea462", "path_pattern_hash": "b1c7373ffa4daadb6ab138f759082d87" }, "target_context": { "dst_port": 18789, "service": "sap-diag", "service_name": "sap-diag", "risk_score": 24 }, "payload_preview": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:18789\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n", "request_sample": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:18789\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:18789\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close", "evidence": { "request_sample": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:18789\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:18789\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close", "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "sap_probe" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "59cca65c6201621dab3325b11f47545a6137149f", "protocol_details": { "payload_preview": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:18789\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close", "port": 18789, "service": "sap-diag", "service_label_fr": "SAP Diag" }, "evidence_snippet": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:18789\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close", "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:18789 \u00b7 (sonde \/ probe)", "target_port_label": "18789 \u00b7 SAP Diag", "emulator_service": "sap-diag", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 0%", "classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 40, "protocol": 48, "novelty": 15, "risk_score": 24 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 24, "risk_label": "Faible", "service_name": "sap-diag", "service_label_fr": "SAP Diag", "dst_port": 18789, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-sap-diag", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:18789\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close", "port": 18789, "service": "sap-diag", "service_label_fr": "SAP Diag" }, "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:18789 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:18789\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close", "target_port_label": "18789 \u00b7 SAP Diag", "emulator_service": "sap-diag", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "sap_diag", "service_banner": "honeypot-sap-diag", "service_os": "linux", "dst_port": "18789" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_get_probe", "net_sap_diag_probe", "sap_diag_probe" ], "asn_dc_heuristic": true }
20/07/2026 18:09:35 UTC	TCP	8086 · INFLUXDB	influxdb	Sonde InfluxDB influxdb probe · via INFLUXDB:8086 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur INFLUXDB WAF — Recommandation Surveiller Tags influxdb_emulated influxdb_payload net_influxdb_probe tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8086 Chemin / cible — Service INFLUXDB Payload $ EƜHժ~~�Z��<�- ;AyvC�玺Ct�f �#�!p,Z�;��A�O�R��+;�_-��>�,�0�̨̩̪�+�/��$�(k�#�'g� �9� �3� Pourquoi cette classification : Type « influxdb_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 45 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) $ EƜHժ~~�Z��<�- ;AyvC�玺Ct�f �#�!p,Z�;��A�O�R��+;�_-��>�,�0�̨̩̪�+�/��$�(k�#�'g� �9� �3� Requête brute (extrait) $ EƜHժ~~�Z��<�- ;AyvC�玺Ct�f �#�!p,Z�;��A�O�R��+;�_-��>�,�0�̨̩̪�+�/��$�(k�#�'g� �9� �3��=<5/�� # ( + - Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a582d496e666c757864622d56657273696f6e3a20322e372e340d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2036370d0a0d0a7b226e616d65223a22686f6e6579706f742d696e666c7578222c226d6573", "emulator_response_len": 165, "bytes_in": 297, "payload_entropy": 5.816857328134461, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "influxdb", "app_proto": "influxdb", "asn": 14061, "country": "DE", "dst_port": 8086, "risk_waf": 8, "risk_classification": 54, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.6, "risk_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 45, "tag_count": 4, "anomaly_count": 0, "campaign_key": "616d33e8b5edab9d02f533b6029e3545f5563b64", "event_fingerprint": "a36e838654a329836d00a8ed03fe3d1cba6e1fed", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab influxdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 45 }, "service_name": "influxdb", "risk_confidence_factor": 50, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "DE", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0e362c9bd869432c488a0401c42e897d", "path_pattern_hash": "4c5f284725807ee704527650cfbb162b" }, "target_context": { "dst_port": 8086, "service": "influxdb", "service_name": "influxdb", "risk_score": 45 }, "payload_snippet": "\u0016\u0003\u0001\u0001$\u0001\u0000\u0001 \u0003\u0003E\u019cH\u056a~~\ufffd\u001fZ\ufffd\ufffd\ufffd<\ufffd-\n;AyvC\ufffd\u73baCt\ufffdf \ufffd#\u000e\ufffd!p,Z\ufffd;\ufffd\u001b\u0004\ufffd\ufffdA\ufffdO\ufffdR\ufffd\ufffd\ufffd+;\ufffd_-\u001c\ufffd\ufffd\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0001$\u0001\u0000\u0001 \u0003\u0003E\u019cH\u056a~~\ufffd\u001fZ\ufffd\ufffd\ufffd<\ufffd-\n;AyvC\ufffd\u73baCt\ufffdf \ufffd#\u000e\ufffd!p,Z\ufffd;\ufffd\u001b\u0004\ufffd\ufffdA\ufffdO\ufffdR\ufffd\ufffd\ufffd+;\ufffd_-\u001c\ufffd\ufffd\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u0000-\u0000\u0002\u0001\u0001\u0000", "payload_snippet": "\u0016\u0003\u0001\u0001$\u0001\u0000\u0001 \u0003\u0003E\u019cH\u056a~~\ufffd\u001fZ\ufffd\ufffd\ufffd<\ufffd-\n;AyvC\ufffd\u73baCt\ufffdf \ufffd#\u000e\ufffd!p,Z\ufffd;\ufffd\u001b\u0004\ufffd\ufffdA\ufffdO\ufffdR\ufffd\ufffd\ufffd+;\ufffd_-\u001c\ufffd\ufffd\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd", "classification_reason": "Type \u00ab influxdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0d0cf6ae3edf5f45263f2e8a709e665196fad79e", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0001$\u0001\u0000\u0001 \u0003\u0003E\u019cH\u056a~~\ufffd\u001fZ\ufffd\ufffd\ufffd<\ufffd-\n;AyvC\ufffd\u73baCt\ufffdf \ufffd#\u000e\ufffd!p,Z\ufffd;\ufffd\u001b\u0004\ufffd\ufffdA\ufffdO\ufffdR\ufffd\ufffd\ufffd+;\ufffd_-\u001c\ufffd\ufffd\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd", "port": 8086, "service": "influxdb", "service_label_fr": "INFLUXDB" }, "evidence_snippet": "$ E\u019cH\u056a~~\ufffdZ\ufffd\ufffd\ufffd<\ufffd-\n;AyvC\ufffd\u73baCt\ufffdf \ufffd#\ufffd!p,Z\ufffd;\ufffd\ufffd\ufffdA\ufffdO\ufffdR\ufffd\ufffd\ufffd+;\ufffd_-\ufffd\ufffd\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd", "attack_vector": "influxdb probe \u00b7 via INFLUXDB:8086 \u00b7 (sonde \/ probe)", "target_port_label": "8086 \u00b7 INFLUXDB", "emulator_service": "influxdb", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab influxdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab influxdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 45 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "influxdb", "service_label_fr": "INFLUXDB", "dst_port": 8086, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-influxdb", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0001$\u0001\u0000\u0001 \u0003\u0003E\u019cH\u056a~~\ufffd\u001fZ\ufffd\ufffd\ufffd<\ufffd-\n;AyvC\ufffd\u73baCt\ufffdf \ufffd#\u000e\ufffd!p,Z\ufffd;\ufffd\u001b\u0004\ufffd\ufffdA\ufffdO\ufffdR\ufffd\ufffd\ufffd+;\ufffd_-\u001c\ufffd\ufffd\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd", "port": 8086, "service": "influxdb", "service_label_fr": "INFLUXDB" }, "attack_vector": "influxdb probe \u00b7 via INFLUXDB:8086 \u00b7 (sonde \/ probe)", "evidence_snippet": "$ E\u019cH\u056a~~\ufffdZ\ufffd\ufffd\ufffd<\ufffd-\n;AyvC\ufffd\u73baCt\ufffdf \ufffd#\ufffd!p,Z\ufffd;\ufffd\ufffd\ufffdA\ufffdO\ufffdR\ufffd\ufffd\ufffd+;\ufffd_-\ufffd\ufffd\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd", "target_port_label": "8086 \u00b7 INFLUXDB", "emulator_service": "influxdb", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "influxdb", "service_banner": "honeypot-influxdb", "service_os": "linux", "dst_port": "8086" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "influxdb_emulated", "influxdb_payload", "net_influxdb_probe", "tls_clienthello" ], "asn_dc_heuristic": true }
20/07/2026 17:44:55 UTC	TCP	9042 · CASSANDRA	cassandra	Sonde PostgreSQL postgres probe · via CASSANDRA:9042 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 1b9bb541fa237aff SNI 62.3.50.33 Émulateur CASSANDRA WAF — Recommandation Surveiller Tags cassandra_emulated net_cassandra_native tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9042 Chemin / cible — Service CASSANDRA SNI TLS 62.3.50.33 Payload ��9 �/��1�6�g�u�� yD��x��4�P�/�+�� /5� �$�#��(�'̨̩̪kg93=<��,�0 Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��9�/��1�6�g�u�� yD��x��4�P�/�+�� /5� �$�#��(�'̨̩̪kg93=<��,�0 Requête brute (extrait) ��9 �/��1�6�g�u�� yD��x��4�P�/�+�� /5� �$�#��(�'̨̩̪kg93=<��,�0G 62.3.50.33 � Meta JSON brut { "protocol_emulated": true, "emulator_response": "840000000200000002", "emulator_response_len": 9, "bytes_in": 201, "payload_entropy": 5.057472370561788, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "cassandra", "app_proto": "cassandra", "asn": 14061, "country": "DE", "dst_port": 9042, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.4, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "40a95b0e32b0df6949d23e1558297d2ebdc45aed", "event_fingerprint": "a0aaefdb49226dd6e2577aeda4227e02b3ddd691", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 35 }, "named_classification_skipped": false, "service_name": "cassandra", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "DE", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "181f86cb18bc598d0c5ab29f3af4d378", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5", "ja3": "1b9bb541fa237aff65acf838b154df7f", "ja4": "7d55a26b02c27f625ff34bc84f8ab649", "tls_version": "0x0303", "tls_cipher_count": 40, "tls_sni": "62.3.50.33", "ja3_client_category": "nmap_scanner" }, "tls_ja3_hash": "1b9bb541fa237aff65acf838b154df7f", "tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10-49188-49187-49160-158-157-156-49192-49191-52393-52392-52394-107-103-57-51-22-61-60-4-20-159-21-49196-49200-8-6-3,0-5-10-11-13-65281,23-24-25,0", "tls_ja4_hash": "7d55a26b02c27f625ff34bc84f8ab649", "tls_ja4": "t13d0140_c79c1c2c7c3c_40d2e578a3e2", "tls_version": "0x0303", "tls_cipher_count": 40, "tls_sni": "62.3.50.33", "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 9042, "service": "cassandra", "service_name": "cassandra", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00039\f\ufffd\/\ufffd\ufffd1\ufffd6\ufffdg\ufffdu\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffdyD\ufffd\ufffd\ufffdx\ufffd\ufffd4\ufffd\u0000\u0000P\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd$\ufffd#\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd(\ufffd'\u0329\u0328\u032a\u0000k\u0000g\u00009\u00003\u0000\u0016\u0000=\u0000<\u0000\u0004\u0000\u0014\u0000\ufffd\u0000\u0015\ufffd,\ufffd0\u0000\b\u0000\u0006\u0000\u0003\u0001\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00039\f\ufffd\/\ufffd\ufffd1\ufffd6\ufffdg\ufffdu\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffdyD\ufffd\ufffd\ufffdx\ufffd\ufffd4\ufffd\u0000\u0000P\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd$\ufffd#\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd(\ufffd'\u0329\u0328\u032a\u0000k\u0000g\u00009\u00003\u0000\u0016\u0000=\u0000<\u0000\u0004\u0000\u0014\u0000\ufffd\u0000\u0015\ufffd,\ufffd0\u0000\b\u0000\u0006\u0000\u0003\u0001\u0000\u0000G\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00039\f\ufffd\/\ufffd\ufffd1\ufffd6\ufffdg\ufffdu\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffdyD\ufffd\ufffd\ufffdx\ufffd\ufffd4\ufffd\u0000\u0000P\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd$\ufffd#\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd(\ufffd'\u0329\u0328\u032a\u0000k\u0000g\u00009\u00003\u0000\u0016\u0000=\u0000<\u0000\u0004\u0000\u0014\u0000\ufffd\u0000\u0015\ufffd,\ufffd0\u0000\b\u0000\u0006\u0000\u0003\u0001\u0000", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6b83ce335b34bd97c5e5ad7c3cac08a80db3afc9", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00039\f\ufffd\/\ufffd\ufffd1\ufffd6\ufffdg\ufffdu\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffdyD\ufffd\ufffd\ufffdx\ufffd\ufffd4\ufffd\u0000\u0000P\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd$\ufffd#\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd(\ufffd'\u0329\u0328\u032a\u0000k\u0000g\u00009\u00003\u0000\u0016\u0000=\u0000<\u0000\u0004\u0000\u0014\u0000\ufffd\u0000\u0015\ufffd,\ufffd0\u0000\b\u0000\u0006\u0000\u0003\u0001\u0000", "tls_ja3": "1b9bb541fa237aff65acf838b154df7f", "tls_ja4": "7d55a26b02c27f625ff34bc84f8ab649", "tls_sni": "62.3.50.33", "port": 9042, "service": "cassandra", "service_label_fr": "CASSANDRA" }, "evidence_snippet": "\ufffd\ufffd9\ufffd\/\ufffd\ufffd1\ufffd6\ufffdg\ufffdu\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffdyD\ufffd\ufffd\ufffdx\ufffd\ufffd4\ufffdP\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n\ufffd$\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd(\ufffd'\u0329\u0328\u032akg93=<\ufffd\ufffd,\ufffd0", "attack_vector": "postgres probe \u00b7 via CASSANDRA:9042 \u00b7 (sonde \/ probe)", "target_port_label": "9042 \u00b7 CASSANDRA", "emulator_service": "cassandra", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "cassandra", "service_label_fr": "CASSANDRA", "dst_port": 9042, "protocol_emulated": true, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-cassandra", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00039\f\ufffd\/\ufffd\ufffd1\ufffd6\ufffdg\ufffdu\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffdyD\ufffd\ufffd\ufffdx\ufffd\ufffd4\ufffd\u0000\u0000P\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd$\ufffd#\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd(\ufffd'\u0329\u0328\u032a\u0000k\u0000g\u00009\u00003\u0000\u0016\u0000=\u0000<\u0000\u0004\u0000\u0014\u0000\ufffd\u0000\u0015\ufffd,\ufffd0\u0000\b\u0000\u0006\u0000\u0003\u0001\u0000", "tls_ja3": "1b9bb541fa237aff65acf838b154df7f", "tls_ja4": "7d55a26b02c27f625ff34bc84f8ab649", "tls_sni": "62.3.50.33", "port": 9042, "service": "cassandra", "service_label_fr": "CASSANDRA" }, "attack_vector": "postgres probe \u00b7 via CASSANDRA:9042 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd9\ufffd\/\ufffd\ufffd1\ufffd6\ufffdg\ufffdu\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffdyD\ufffd\ufffd\ufffdx\ufffd\ufffd4\ufffdP\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n\ufffd$\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd(\ufffd'\u0329\u0328\u032akg93=<\ufffd\ufffd,\ufffd0", "target_port_label": "9042 \u00b7 CASSANDRA", "emulator_service": "cassandra", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "cassandra", "service_banner": "honeypot-cassandra", "service_os": "linux", "dst_port": "9042" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "cassandra_emulated", "net_cassandra_native", "tls_clienthello" ], "asn_dc_heuristic": true }
20/07/2026 17:44:54 UTC	TCP	9042 · CASSANDRA	cassandra	Protocole natif Cassandra cassandra native · via CASSANDRA:9042 · (sonde / probe)	Élevée	Faible · 37
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur CASSANDRA WAF — Recommandation Surveiller Tags cassandra_emulated http_get_probe mozi_pattern net_cassandra_native Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9042 Chemin / cible — Service CASSANDRA Payload GET / HTTP/1.1 Host: 62.3.50.33:9042 User-Agent: Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/) Accept: / Accep Pourquoi cette classification : Type « cassandra_native » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 37 Confiance : Confiance 0 % — 4 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:9042 User-Agent: Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/) Accept: / Accep Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:9042 User-Agent: Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/) Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "840000000200000002", "emulator_response_len": 9, "bytes_in": 148, "payload_entropy": 5.1417076098349215, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "cassandra", "app_proto": "cassandra", "asn": 14061, "country": "DE", "dst_port": 9042, "risk_waf": 8, "risk_classification": 54, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 40, "risk_novelty": 15, "risk_boost": 20, "risk_granularity": 4.8, "risk_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 15 }, "risk_score": 37, "tag_count": 4, "anomaly_count": 0, "campaign_key": "b8cc2731612d020ecdcab58b5df800413f79ea60", "event_fingerprint": "a0aaefdb49226dd6e2577aeda4227e02b3ddd691", "classification_reason": "Type \u00ab cassandra_native \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 15, "risk_score": 37 }, "named_classification_skipped": false, "service_name": "cassandra", "risk_confidence_factor": 0, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "DE", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "3d7db0c7621e936e9d1257ed1b89b879", "path_pattern_hash": "8cb32c8386aedd3a6f34609a4f02f539" }, "target_context": { "dst_port": 9042, "service": "cassandra", "service_name": "cassandra", "risk_score": 37 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9042\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: \/\r\nAccep", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9042\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9042\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: \/\r\nAccep", "evidence": { "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9042\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9042\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: \/\r\nAccep", "classification_reason": "Type \u00ab cassandra_native \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "7e4df39a000b137cbec5cf739f02cccbbc99fd44", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9042\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: \/\r\nAccep", "port": 9042, "service": "cassandra", "service_label_fr": "CASSANDRA" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9042\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: \/\r\nAccep", "attack_vector": "cassandra native \u00b7 via CASSANDRA:9042 \u00b7 (sonde \/ probe)", "target_port_label": "9042 \u00b7 CASSANDRA", "emulator_service": "cassandra", "confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab cassandra_native \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab cassandra_native \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 37\/100", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 15, "risk_score": 37 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 37, "risk_label": "Faible", "service_name": "cassandra", "service_label_fr": "CASSANDRA", "dst_port": 9042, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-cassandra", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9042\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: \/\r\nAccep", "port": 9042, "service": "cassandra", "service_label_fr": "CASSANDRA" }, "attack_vector": "cassandra native \u00b7 via CASSANDRA:9042 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9042\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: \/\r\nAccep", "target_port_label": "9042 \u00b7 CASSANDRA", "emulator_service": "cassandra", "confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "cassandra", "service_banner": "honeypot-cassandra", "service_os": "linux", "dst_port": "9042" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "cassandra_emulated", "http_get_probe", "mozi_pattern", "net_cassandra_native" ], "asn_dc_heuristic": true }

Réputation

Sécurité avancée

Offensive / Recon

Sécurité

DNS

Réseau

E-mail

IP

Utilitaires

165.232.120.46

Profil de menace

Pourquoi listée

Comparaison ASN / FAI

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence